Ready to be published? LXer is read by around 350,000 individuals each month, and is an excellent place for you to publish your ideas, thoughts, reviews, complaints, etc. Do you have something to say to the Linux community?
It is important to understand ports, their details and their numbers.
Q. What is a port?
A port is piece of software which is used as docking point in your machine, where remote application can communicate. This is analogy to the physical ports for entering in to a country from different sea ports.
Q. What is a port?
A port is piece of software which is used as docking point in your machine, where remote application can communicate. This is analogy to the physical ports for entering in to a country from different sea ports.
Q. What is hardware port?
This is a physical peripheral connecting point to a machine from a physical device.
Q. What is a socket?
Socket is combination of software Port and IP address.
Q. What is the range of ports or how many ports are there?
Port numbers can vary from 0 to 65535, so total we can get 65536 ports
Q. Why port numbers are just 65536?
This is because limitation in TCP/IP stack where the port number field is just 16bit size. So we get only 2^16(2 to the power of 16) ports which are equal to 65536 available ports
Q. What are the well-known ports or assigned ports or default ports?
Well known ports are from 0 to 1023(total 2^10=1024 ports)
Q. What do you mean by default port?
Default port is a designated port for particular well-known service such as web server, mail server, ftp server etc. By default FTP uses 21 port, DNS uses 53 and Apache uses 80 port.
Q. Can we change default port for a service(example Apache, squid)?
Yes, we can change. In Apache and DNS we can change this using listen configuration entry in httpd.conf and named.conf. Squid have port entry in its squid.conf file to mention port number.
Q. What are the protocol numbers for TCP and UDP?
Do not confuse this one with port numbers. TCP and UDP have their own numbers in TCP/IP stack.
TCP protocol number: 6
UDP protocol number: 17
Q. Is there any way I can see all the port information in Linux?
Yes, you can get that from /etc/services files.
Q. How can I see open ports in Linux?
Use nmap command.
Well known ports
20 – FTP Data (For transferring FTP data)
21 – FTP Control (For starting FTP connection)
22 – SSH (For secure remote administration which uses SSL to encrypt the transmission)
23 – Telnet (For insecure remote administration)
25 – SMTP (Mail Transfer Agent for e-mail server such as SEND mail)
53 – DNS (Special service which uses both TCP and UDP)
67 – Bootp
68 – DHCP
69 – TFTP (Trivial file transfer protocol uses udp protocol for connection less transmission of data)
80 – HTTP/WWW(Apache)
88 – Kerberos
110 – POP3 (Mail delivery Agent)
123 – NTP (Network time protocol used for time syncing uses UDP protocol)
137 – NetBIOS (nmbd)
139 – SMB-Samba (smbd)
143 – IMAP
161 – SNMP (For network monitoring)
389 – LDAP (For centralized administration)
443 – HTTPS (HTTP+SSL for secure web access)
514 – Syslogd (udp port)
636 – ldaps (both ctp and udp)
873 – rsync
989 – FTPS-data
990 – FTPS
993 – IMAPS
1194 – openVPN
1812 – RADIUS
995 – POP3s
2049 – NFS (nfsd, rpc.nfsd, rpc, portmap)
2401 – CVS server
3306 – MySql
3690 – SVN
6000-6063-X11
Note 1: If protocol(TCP or UDP) is not mention then the above port are solely for TCP. Some service use UDP as mention in above list.
Note 2: X11 use 6000 to 6063.. ports for connecting X11 from remote server.
But... one of my pet peeves is the continual appearance of 'nmap' for locating open ports.
nmap is not a system tool. nmap is a tool for scanning other machines in a network. nmap is generally not installed by default in many GNU/Linux distros.
The correct system tool for looking at ports on a given machine is:
To see all open [listening] ports and sockets on a GNU/Linux machine:
netstat -l
To see all tcp connections:
netstat -t
****
However, if you are trying to find out if a remote machine, to which you do not have administrator access, has open ports... nmap is a decent solution... even though, depending on the bullishness of the admin, its use may result in your IP address getting automatically blocked by the remote machine's firewall
I agree with all those points. It is rather overkill to scan your own machine when netstat is so handy.
One other use I've made of nmap was to save time while administering 25 machines in a university classroom where the IP addresses were assigned dynamically. It was easy to nmap the subnet and look for the "signature" of my 25 machines while sorting the wheat (my pristine Linux machines) from the chaff (another couple hundred virus-laden Windows boxes).
nmap from a remote machine is what you use when you suspect the machine under test has been compromised. ps, netstat, lsof, ls, and top are the first executables to be replaced; they hide the nefarious activity from resource listings.
which tells me which users and which programs are making those internet connections, as well.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
nmap is not a system tool. nmap is a tool for scanning other machines in a network. nmap is generally not installed by default in many GNU/Linux distros.
The correct system tool for looking at ports on a given machine is:
netstat
Documentation: http://linux.die.net/man/8/netstat
To see all open [listening] ports and sockets on a GNU/Linux machine:
netstat -l
To see all tcp connections:
netstat -t
****
However, if you are trying to find out if a remote machine, to which you do not have administrator access, has open ports... nmap is a decent solution... even though, depending on the bullishness of the admin, its use may result in your IP address getting automatically blocked by the remote machine's firewall