Service Inspector
Enter a host or IP and SysGlass scans the privileged ports (TCP 1-1024 plus the high-value UDP services), works out the real protocol speaking on each open port from its live response — not just the port number — and runs a safe, read-only deep probe of every service it finds. Instead of only telling you 'port 445 is open', it tells you 'SMB is exposed with SMBv1 enabled and signing not required — close it at the firewall or restrict to a VPN.' Every open service gets a risk badge and a copy-paste fix.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Open TCP ports 1-1024 and the important UDP services (DNS, NTP, SNMP, IKE, IPMI, rpcbind and more)
- SSH: protocol version, host keys, weak key-exchange/cipher/MAC algorithms
- Mail: SMTP/IMAP/POP STARTTLS, plaintext-auth-before-TLS, certificates, open-relay (safe, no message sent)
- DNS: open recursion, version disclosure, zone-transfer exposure (your own domain only), amplification
- Windows/file: SMB dialects + SMBv1 + signing, NetBIOS, LDAP anonymous bind, rpcbind/NFS
- Management & IoT: SNMP, IPMI/BMC, exposed databases (Redis/Mongo/Elasticsearch), printers, cameras
- TLS on any port: version, cipher and certificate, with weak-TLS flagged
How to read the result
- Each open service shows a risk badge: expected, exposed-admin, plaintext, legacy, unauthenticated, tls-weak or amplifier.
- OK means only expected services are reachable and nothing risky was found.
- Warn flags weak configuration — old TLS, plaintext auth, missing SMB signing, a public SNMP agent.
- Critical means a service is reachable that almost never should be — an unauthenticated database, a public BMC, an open DNS resolver or a plaintext admin login.
- Every probe is read-only: no logins are attempted, no data is sent, and no exploitation is performed.
Frequently asked questions
How is this different from the open-port check?
The open-port check tells you which ports are open. The Service Inspector goes further: it identifies the real service on each open port and runs a protocol-specific safe check — so you get the SSH algorithm list, the SMTP TLS posture, whether SMB signing is required, and the exact remediation, not just 'open'.
Is it safe / non-intrusive?
Yes. Every probe is read-only and bounded: it never brute-forces credentials, never writes, sends no email body in the relay test, and only attempts a zone transfer for a domain you entered yourself. It identifies and explains exposure — it does not exploit it.
Does it scan UDP too?
By default it probes the high-value UDP services (DNS, NTP, SNMP, IKE, IPMI and similar). Full mode also sweeps UDP 1-1024. UDP results are honestly reported as open or open/filtered when a service doesn't reply.
Why is an exposed database or BMC critical?
An unauthenticated Redis/MongoDB/Elasticsearch instance or a public IPMI/BMC management interface is a direct path to data theft or full server takeover. These should never face the public internet — bind them to localhost or put them behind a VPN.