下面用紅色注明的地方，可以讓黑客識別出你是否是ROS設備的端口
ip-service:
api 8728
api-ssl 8729
ftp 21
ssh 22
telnet 23
winbox 8291
www 80
www-ssl 443
ppp-sstp-server 443
ip dns -udp 53
ppp-pptp tcp 1723
ppp-l2tp udp 500 4500 1701
ppp-ovpn 1194
tools -BTest Server 監聽2000端口
ip-socks 如果被開啟enabled，那么很可能被黑客入侵了。
ip Web Proxy 默認開啟8080端口
ip firewall nat你做端口映射別人也可以掃描到
使用nmap可以把端口掃描出來，用-A可以識別出你是否是ROS設備
NMAP基本用法：
參考鏈接：https://blog.csdn.net/qq_41880069/article/details/82792896
ros的0day漏洞需要用到的工具
nmap,python3.5以上版本，WinboxPoC-master.rar(python腳本)
https://files.cnblogs.com/files/itfat/WinboxPoC-master.rar
對付0day漏洞，首要的就是把ros升級到6.42以上版本。
其次如果你升級不了的話，可以使用我之前的文章，用二次碰撞來防御
https://www.cnblogs.com/itfat/p/12815406.html
或者用下面的防護腳本，但是你的ROS如果對外提供服務，那么需要提前開放端口
禁止端口掃描的安全防護策略
PSD(port scan detection)
/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="Port scanners to list" disabled=no
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan"
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan"
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan"
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan"
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan"
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan"
add chain=input src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no
或者禁止黑客下載你ROS的用戶名和密碼文件
#Mikrotik 0day
/ip firewall filter
add action=reject chain=input comment="SECURITY _0day" content=user.dat \
disabled=yes reject-with=icmp-network-unreachable
add action=drop chain=input content=user.dat disabled=yes