Outbound port tests (beta)
An outbound port test finds which TCP ports can leave the network one of your sensors is installed in. Attackers and malware rely on reaching the internet: a network that lets every port out gives them easy command-and-control channels and ways to move data out. The test shows you exactly what your firewall lets through. [!NOTE] Outbound port tests are in beta. They're marked Beta in the console. Your feedback helps. Outbound port tests are included in every plan. They run from your own sensors only. On one of our cloud scanners they would test our network, not yours. How it works For each port, the sensor connects to a public test service that answers on every TCP port. It sends a plain web request and checks that the reply really comes from that service. Each port gets one of three results: Result What it means Allowed out The test service's own reply came back: traffic on this port leaves your network. Blocked The connection was refused or dropped. With two or more services chosen, the port is tried on a second service before it's called blocked. Intercepted Something answered, but it wasn't the test service. Usually a proxy, or a firewall inspecting the traffic. Also shown when the service answered for a different port, meaning something redirected the connection. Nothing but a plain web request is sent, and nothing is installed or changed. Start a test Go to Scans → New scan. Choose one of your own sensors, and the scan type Outbound ports. Choose the test services (all three by default): open.zorinaq.com names the port it was reached on, so redirects show up. letmeoutofyour.net portquiz.net answers on most ports. Choose the ports to test. The default is the 1,000 most common TCP ports plus known risky outbound ports. You can pick a port list, or type ports (for example 1-65535 for every port; that takes about 20 minutes). Start the test, or choose When to repeat it on a schedule. The test services are free public services run by others. OrbitalCyber spreads the ports across the services you choose and keeps only a few connections open to each. Results and findings The scan page shows how many ports were allowed, blocked and intercepted, how many ports each test service answered, and every port with its result. You can filter by result and search by port. Each sensor gets an asset called Outbound from \<sensor name\> (under Assets → Outbound traffic). It holds the findings: Finding Severity Outbound SMB (TCP 445) allowed High Outbound RDP (3389), Telnet (23), SMTP (25), Microsoft RPC (135), NetBIOS (139), VNC (5900), IRC (6667, 6697) or Tor (9001, 9030) allowed Medium Outbound FTP (21), SOCKS (1080), database ports (1433, 1521, 3306, 5432) or 4444 allowed Low No outbound filtering: at least 90% of 100 or more tested ports allowed Medium A later test from the same sensor marks a finding fixed when that port is no longer allowed. Only ports the later test actually tried can be marked fixed. Limits TCP only for now. The public test services don't answer UDP, so UDP ports (DNS, NTP, QUIC) aren't tested. If no test service answers on any port, the scan says so. Either all outbound traffic is filtered, or the services are down.
OrbitalCyber documentation