Hi,
How can I discover server dependencies? For example, how do I find out what services depend on email? Is it with nmap?
Thanks!

Hi,

not very clear what are you really looking for, but maybe this can help:
If you're trying to look for what network services the server is acting as a client (that is, applications running on the server that are acting as clients with regard to some network services):
1. netstat: look at external ports/services the server has in state ESTABLISHED or CLOSE_WAIT; run this command if you have a login account on the server. You could find services provided by the server itself (i.e. applications from the monitored server connecting to TCP/UDP sockets on the server itself).
2. a network traffic sniffing tool (i.e. tcpdump, wireshark, etc.) may also do the job, provided they are run for a sufficiently long time (many applications may have permanet traffic with external services while others may just connect once in a while). You don't have to run tcpdump or wireshark on the machine itself, as long as you have a machine in the same subnet as the server you are monitoring with a network interface capable of 'promiscuous mode'.

When you asked for nmap usage, remember that nmap is generally used to discover what network services are listening on the target server. Unless you run nmap on the target server itself, the results returned by nmap may be less comprehensive than the results returned by running netstat (this time, you would look to results with TCP/UDP sockets in state LISTENING), because a firewall may filter some sockets.

see ya
fra

For example, the web server depends on DNS. But I'm not sure if the web server would be a DNS client?

But how do you identify services a server is a client for? Is it if the port is not a common port number?

Basically, I need to find out about server relationships- how to identify what services a server is dependent on. Like how to use CLI for example to find out that email depends on DNS.

Thanks, I appreciate any help!

Hi,

sorry for not being too clear.

netstat can be used in order to look both for services provided by the monitored server and external services for which the server is acting as a client.
Actually netstat output reports both 'Local address' and 'Foreign address' columns: the former is for local network sockets, while the latter is for 'external' network sockets.
When I stated "[...]You could find services provided by the server itself[...]", I meant that you could discover services for which the server is acting both as a server and as a client (trivial case: think about SSHing to the server itself).

I also didn't mention that for UDP traffic for which the server acts as a client with respect to an external service provide, you may never see a corresponding row in netstat output, because UDP connections are stateless by design (for exceptions have a look at: networking - netstat -na : udp and state established? - Stack Overflow that is, netstat output will show UDP sockets just for services for which the server is actually acting as a server.
So, in order to see if an application is using DNS (implemented as a service listening on UDP port 53 on the server side) you'd better use a network traffic sniffing tool.

see ya
fra

Thanks Frappa, that was very helpful and clear.