Port Patrol

Port Patrol is a cross-platform command-line utility that observes your servers for unexpected port state changes and delivers email notifications the instant drift is identified. Specify which ports should be open or closed on each host, and receive alerts within minutes if anything shifts without your approval.

Available for Linux, macOS, and Windows. Single binary, zero dependencies, deploys in seconds.

Why Port Observing Matters

Open ports are the entry points to your server. When an unauthorized service begins listening — whether from a compromised application, a misconfigured firewall rule, or a rogue process — it creates an attack surface you did not intend. Without observing, these changes can go undetected until a breach occurs. Port Patrol closes that gap by verifying your ports on a schedule and notifying you without delay when something drifts.

How It Operates

• You specify expected port states in a simple YAML config — or let the initial run capture a baseline autonomously
• On each scheduled run, Port Patrol scans the specified ports and compares results against your expected values or stored snapshots
• If any port has shifted state, a detailed email notification is sent showing precisely what drifted
• The notification includes the host, port number, expected state, and actual state identified
• When a port returns to its expected state, a recovery notification confirms the issue is resolved
• No repeated notifications — you only receive them on state transitions, not every cron run
• Use --reset to accept legitimate changes and establish a new baseline

What To Observe

• Web servers — ports 80, 443
• SSH access — port 22
• Databases — MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017)
• Mail servers — ports 25, 143, 587, 993
• Application services — custom ports (3000, 8080, 8443, etc.)
• Admin panels — frequent backdoor ports

Core Capabilities

• Observes any TCP port on any number of hosts (IP addresses or hostnames)
• Two identification modes: config-defined expected states (open/closed), or automatic baseline snapshots
• Intelligent alerting — only emails on state transitions, not on every check
• Recovery notifications — receive confirmation when a drifted port returns to normal
• Email notifications via SMTP with TLS (port 465) and STARTTLS (port 587) support
• Concurrent scanning — rapid parallel port checks with configurable concurrency
• Configurable timeout and retries to handle slow or unreliable networks
• Cron-friendly with quiet mode — no noise, notifications only on changes
• Dry-run mode to test your setup without triggering notifications
• Reset mode to capture fresh snapshots after legitimate changes
• Summary reports delivered via email on schedule
• Single-host filtering with --host flag
• Cross-platform — operates on Linux, macOS, and Windows
• Single static binary, zero runtime dependencies
• No root privileges required — uses TCP connect scanning

Ideal For

• Sysadmins catching unauthorized services on production servers
• Security teams identifying backdoor listeners and exposed databases
• Compliance teams meeting PCI-DSS port observing requirements
• DevOps teams catching misconfigured firewall rules after deployments
• MSPs and agencies observing client servers for unexpected exposure

Quick Start

1. Download the binary for your platform
2. Copy config.example.yaml to config.yaml and add your SMTP details and hosts
3. Run portpatrol --config config.yaml --test to verify email operates
4. Run portpatrol --config config.yaml --reset to capture initial snapshots
5. Add a cron job to check every 5 minutes — done