Network Ports

network-ports

network-ports is the rule-view command for visible inbound port and allow posture.

Use it when you need to know which inbound rules or port paths deserve review first without pretending that rule data alone proves end-to-end reachability.

What This Command Answers

• Which visible inbound allow paths matter most first?
• Which rules, source ranges, or ports look most permissive?
• Which network path should you validate or correlate next?

Run It

ho-azure network-ports --output table

For saved structured output:

ho-azure network-ports --output json

Example Table Output

asset	endpoint	protocol	port	allow source	confidence
vm-web-01	52.160.10.20	TCP	22	Any via nic-nsg:.../allow-ssh-internet	high
vm-web-01	52.160.10.20	TCP	443	AzureLoadBalancer via subnet-nsg:.../allow-https...	medium
vm-web-01	52.160.10.20	TCP	8080	10.20.0.0/16 via subnet-nsg:.../allow-app-port	low

When To Use It

• when inbound rule posture is the clearest next network question
• after endpoints or network-effective suggests exposed assets
• when you need exact port, protocol, and source-range context before workload follow-up

What To Look For

• broad inbound allow rules
• management or otherwise sensitive ports
• source ranges such as Any or similarly broad patterns
• rules tied to public-facing or already-interesting workloads

Why It Matters

Visible inbound rules often explain why an endpoint deserves attention.

A broad allow rule, risky management port, or surprisingly open source range can change priority quickly. network-ports gives you the rule evidence behind that story without claiming it is the entire network truth.

What Should Stand Out First

• broad inbound allow rules
• management and sensitive ports
• rules tied to public-facing or important workloads
• clear target context so the path is understandable quickly

If You See..., Go Next To...

• If you see a broad source such as Any on a management port like 22, go next to Network-Effective because it shows whether that rule combines with a real endpoint into a stronger exposure story.
• If the rule is tied to a VM or scale set, go next to vms or vmss because those commands show the workload context behind the port.
• If the reachable asset also carries managed identity, go next to Managed-Identities because it shows whether that exposure is also an Azure token path.

What To Do Next

• Treat the top rules as validation targets, not proof on their own.
• Pair port posture with endpoint and workload context before deciding what matters most.
• Use this command when you need rule-level grounding behind a stronger exposure story.

Loot Behavior

Loot currently keeps the top-ranked rows for this command. That ordering is useful, but it is not yet a shipped semantic high / medium / low analyst contract unless the command explicitly labels rows with a defended priority contract.

Boundary

network-ports is an evidence and grounding command.

It should rank the clearest inbound allow paths. It is not full effective-exposure modeling or confirmed end-to-end reachability.