What is a one sentence summary of your feature request?
Optimize logging so that has a summary of failed targets/ports/services
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
As mentioned in the discussion “WMI hotfix detection failed” ( WMI hotfix detection failed / Access denied when querying Win32_QuickFixEngineering ) the log and the results (html/xml) should mention in a summary that some queries could not be done and the results could have more results.
Here an example how the result could look like
Some targets could not be reached. The report may not include some risks or have missing details. Validate the following table:
| source | target | targetname | protocol | port | servicename | reason |
|---|---|---|---|---|---|---|
| 192.168.0.100 | 172.16.254.100 | EU-DC-12 | tcp | 139 | rpc | syn-sent-timeout |
| 192.168.0.100 | 172.16.254.100 | EU-DC-12 | tcp | 389 | ldap | syn-sent-timeout |
| 192.168.0.100 | 172.16.254.101 | EU-DC-13 | tcp | 389 | ldap | syn-sent-timeout |
| 192.168.0.100 | 172.16.254.101 | EU-DC-13 | tcp | 636 | ldap | syn-sent-timeout |
| 192.168.0.100 | 172.16.254.102 | EU-DC-15 | tcp | 636 | ldap | unexpected response |
| 192.168.0.100 | 172.16.254.102 | EU-DC-16 | tcp | 636 | ldap | tcp-reject |
| 192.168.0.100 | 172.16.254.101 | EU-DC-13 | udp | 56891 | rpc | no response |
| 192.168.0.100 | 172.16.50.50 | EU-WSUS-02 | tcp | 8531 | WSUS | syn-sent-timeout |
Would be great to have information like that in the XML as well.
How do you currently solve the challenges you have by not having this feature?
manually searching for any errors in the log, analyzing it, find out which port is used
or:
monitoring tcp sessions for connections wich are in “syn-sent” state for a while with cmd netstat -noa | find "SYN"or PowerShell with while (1) {Get-NetTCPConnection -State SynSent -ErrorAction SilentlyContinue -OwningProcess $((Get-Process pingcastle).id);Start-Sleep -Milliseconds 500} (abort with CTRL+C - just made that tiny script for this post) or checking firewall logs depending on customer.
If a “SynSent” with equal source:port and target:port is seen more then once then I can assume there was no response within 500ms and the port might be closed or the server/service is not available.
As I use PingCastle in different customer environments as an auditor, I don’t always know what the customer has and some Admins don’t know / can’t see what policies really are in their firewalls.
Afterwards, I generate a list of closed ports to discuss with the customer whether this behavior is intentional.