Port Patrol

Port Patrol is a cross-platform command-line tool that monitors your servers for unexpected port changes and sends email alerts the moment drift is detected. Define which ports should be open or closed on each host, and get notified within minutes if anything changes without your knowledge.

Available for Linux, macOS, and Windows. Single binary, zero dependencies, installs in seconds.

Why Port Monitoring Matters

Open ports are the entry points to your server. When an unauthorized service starts listening — whether from a compromised application, a misconfigured firewall rule, or a rogue process — it creates an attack surface you did not intend. Without monitoring, these changes can go unnoticed until a breach occurs. Port Patrol closes that gap by checking your ports on a schedule and alerting you immediately when something drifts.

How It Works

• You define expected port states in a simple YAML config — or let the first run capture a baseline automatically
• On each scheduled run, Port Patrol scans the specified ports and compares results against your expected values or stored snapshots
• If any port has changed state, a detailed email alert is sent showing exactly what drifted
• The alert includes the host, port number, expected state, and actual state detected
• When a port returns to its expected state, a recovery email is sent confirming the issue is resolved
• No repeated alerts — you only get notified on state transitions, not every cron run
• Use --reset to accept legitimate changes and establish a new baseline

What To Monitor

• Web servers — ports 80, 443
• SSH access — port 22
• Databases — MySQL (3306), PostgreSQL (5432), Redis (6379), MongoDB (27017)
• Mail servers — ports 25, 143, 587, 993
• Application services — custom ports (3000, 8080, 8443, etc.)
• Admin panels — common backdoor ports

Key Features

• Monitors any TCP port on any number of hosts (IP addresses or hostnames)
• Two detection modes: config-defined expected states (open/closed), or automatic baseline snapshots
• Smart alerting — only emails on state transitions, not on every check
• Recovery notifications — get confirmation when a drifted port returns to normal
• Email alerts via SMTP with TLS (port 465) and STARTTLS (port 587) support
• Concurrent scanning — fast parallel port checks with configurable concurrency
• Configurable timeout and retries to handle slow or flaky networks
• Cron-friendly with quiet mode — no noise, alerts only on changes
• Dry-run mode to test your setup without triggering alerts
• Reset mode to take fresh snapshots after legitimate changes
• Summary reports sent via email on schedule
• Single-host filtering with --host flag
• Cross-platform — runs on Linux, macOS, and Windows
• Single static binary, zero runtime dependencies
• No root privileges required — uses TCP connect scanning

Who Needs This

• Sysadmins catching unauthorized services on production servers
• Security teams detecting backdoor listeners and exposed databases
• Compliance teams meeting PCI-DSS port monitoring requirements
• DevOps teams catching misconfigured firewall rules after deployments
• MSPs and agencies monitoring client servers for unexpected exposure

Quick Start

1. Download the binary for your platform
2. Copy config.example.yaml to config.yaml and add your SMTP details and hosts to monitor
3. Run portpatrol --config config.yaml --test to verify email works
4. Run portpatrol --config config.yaml --reset to take initial snapshots
5. Add a cron job to check every 5 minutes — done