下面用红色注明的地方，可以让黑客识别出你是否是ROS设备的端口
ip-service:
api 8728
api-ssl 8729
ftp 21
ssh 22
telnet 23
winbox 8291
www 80
www-ssl 443
ppp-sstp-server 443
ip dns -udp 53
ppp-pptp tcp 1723
ppp-l2tp udp 500 4500 1701
ppp-ovpn 1194
tools -BTest Server 监听2000端口
ip-socks 如果被开启enabled，那么很可能被黑客入侵了。
ip Web Proxy 默认开启8080端口
ip firewall nat你做端口映射别人也可以扫描到
使用nmap可以把端口扫描出来，用-A可以识别出你是否是ROS设备
NMAP基本用法：
参考链接：https://blog.csdn.net/qq_41880069/article/details/82792896
ros的0day漏洞需要用到的工具
nmap,python3.5以上版本，WinboxPoC-master.rar(python脚本)
https://files.cnblogs.com/files/itfat/WinboxPoC-master.rar
对付0day漏洞，首要的就是把ros升级到6.42以上版本。
其次如果你升级不了的话，可以使用我之前的文章，用二次碰撞来防御
https://www.cnblogs.com/itfat/p/12815406.html
或者用下面的防护脚本，但是你的ROS如果对外提供服务，那么需要提前开放端口
禁止端口扫描的安全防护策略
PSD(port scan detection)
/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="Port scanners to list" disabled=no
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan"
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan"
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan"
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan"
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan"
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan"
add chain=input src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no
或者禁止黑客下载你ROS的用户名和密码文件
#Mikrotik 0day
/ip firewall filter
add action=reject chain=input comment="SECURITY _0day" content=user.dat \
disabled=yes reject-with=icmp-network-unreachable
add action=drop chain=input content=user.dat disabled=yes