Learn / Networking Fundamentals / Names and Services

Ports and Services

guidedeasy 25 min · 80 points

First Bit is still up for grabs: be the first to finish this room.

An IP address gets traffic to the right machine. A port gets it to the right program on that machine. One server can run a website, an SSH server and a mail server at once, each listening on its own port.

Knowing which ports are open, and why, is one of the first things an administrator checks and one of the first things an attacker looks for. In this room you'll learn the common ones and check what's listening on a live machine.

CYB//RANGE Live lab

Task 1 What a port is

A port is a number from 0 to 65535. A connection is identified by both addresses and both ports, which is how one machine can hold thousands of conversations at once.

Services use well-known ports by convention:

Port	Service
22	SSH (remote shell)
25	SMTP (sending mail)
53	DNS
80	HTTP (web)
443	HTTPS (encrypted web)
3306	MySQL
8080	a common "alternative web" port

These are conventions, not rules: any service can listen on any port. That's why you check what's actually listening rather than assume.

Ports belong to a transport protocol. TCP sets up a connection and makes sure data arrives complete and in order (web, SSH, mail). UDP just sends individual messages with no guarantees, which is faster for small, quick exchanges (DNS lookups, video calls). TCP port 53 and UDP port 53 are separate things.

Which port does SSH use by default?

**

Which port does HTTPS use by default?

***

Besides TCP, which transport protocol do ports belong to? (Three letters.)

***

Task 2 What's listening here

ss ("socket statistics") shows the machine's network connections. The options you'll combine most:

Option	Means
`-t`	TCP
`-u`	UDP
`-l`	only listening sockets (services waiting for connections)
`-n`	show numbers, not names (`22` rather than `ssh`)
`-p`	show which program owns each socket (you'll only see details for your own processes unless you're root)

So ss -tln means "listening TCP sockets, numerically":

$ ss -tln
State   Recv-Q  Send-Q  Local Address:Port  Peer Address:Port
LISTEN  0       128           0.0.0.0:22         0.0.0.0:*
LISTEN  0       100         127.0.0.1:25         0.0.0.0:*

The local address tells you who can reach it. 0.0.0.0 (or *) means every interface, so other machines can connect. 127.0.0.1 means loopback only: just this machine.

To talk to a service by hand, nc (netcat) opens a raw connection and shows whatever the service sends back: nc 127.0.0.1 25. Press Ctrl+C to close it.

Which ss option limits the list to sockets that are listening for connections?

**

Which ss option shows port numbers instead of service names?

**

Task 3 Try it on a real machine

Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as jo.
List the listening TCP ports: ss -tln. Which are the well-known ones, and which listen only on 127.0.0.1?
One port doesn't match any service you know. Connect to it with nc and see what it says.

The machine runs a web server on a non-standard port. Which one?

****

One more TCP port is listening that isn't SSH (22), mail (25), DNS (53) or the web server. Which?

****

Connect to that port. What token does the service give you?

RZ{************************}