Port Drift Detector
A read-only Bash toolkit that inventories every listening TCP/UDP port on a Linux host, maps it to the owning process and unit, diffs against an expected baseline you declare once, and flags silent drift — new listeners, moved ports, processes that used to bind 127.0.0.1 but now bind 0.0.0.0, unit files whose ExecStart changed. Runs nightly, diffs visibly. Catches the 'who opened 8080?' question before the pen-tester does.
- ▸port-drift-detector.sh — Main scanner: maps every listener to PID, process name, and systemd unit; writes a normalized snapshot
- ▸baseline-check.sh — Diff engine: flags NEW, WIDEN, MOVED, and GONE drift in severity order; exits non-zero on any finding
- ▸baseline.conf — Human-editable expected-state declaration with commented examples for 10 common services
- ▸install.sh — Idempotent installer: creates log directory, drops logrotate config, installs nightly cron job; includes --uninstall
- ▸port-drift-logrotate.conf — Daily log rotation, 30-day retention, compressed; ready for /etc/logrotate.d/
- ▸runbook.md — Full operator runbook: baseline capture, all four alert types, remediation steps, FAQ (IPv6, alerting, busybox)
- ▸README.md — Quick start, baseline format explanation, architecture diagram, companion product notes
## goes-well-with
From the same shelf
AI-Augmented IR Tabletop Exercise Kit
Run your first IR tabletop without hiring a red team.
ASTGL PowerCLI Automation Cookbook v1.0
14 production-ready PowerShell 7 scripts for vSphere admins — built for Broadcom VCF.PowerCLI, ships-to-vCenter ready.
MCP Server Setup Guide for Sysadmins
A hands-on guide for sysadmins and IT pros to deploy, configure, and secure local MCP servers — covering tool selection, auth patterns, network exposure controls, and integration with Claude Code and local LLMs.
## not-ready-to-buy
Take the field notes instead
One practical write-up a week from the same workbench these kits come from — plus reader pricing when new kits ship.