Unit 7: The network from the host · Lesson 4 of 7 · 14 min
Checking reachability
Use nc to test whether a port answers, and read the difference between open and refused.
mission
- You are
- You are verifying the port list from the inside.
- Situation
- The inventory says db01 runs PostgreSQL on 5432, not web01. You want to prove nothing on web01 answers there.
- Goal
- Test a set of ports with nc and record which are open.
- Hand in
- Open and closed ports on 127.0.0.1.
Three answers
- openSomething accepted the connection
- refusedNothing listens there
- timeoutA firewall probably dropped it
Knock on one door
nc -zv 127.0.0.1 22 Connection to 127.0.0.1 22 port [tcp/ssh] succeeded! nc -zv 127.0.0.1 5432 nc: connect to 127.0.0.1 port 5432 (tcp) failed: Connection refused
you should see -z connects without sending data, -v reports the result. Refused means nothing listens there.
Sweep your own machine
for p in 22 80 443 3306 4444 5432 8081; do nc -z -w1 127.0.0.1 $p && echo "$p open" || echo "$p closed"; done
Connection to 127.0.0.1 22 port [tcp/ssh] succeeded!
22 open
80 closed
443 closed
3306 closed
Connection to 127.0.0.1 4444 port [tcp/*] succeeded!
4444 open
5432 closed
Connection to 127.0.0.1 8081 port [tcp/tproxy] succeeded!
8081 open
you should see The same answer ss gave. Two tools agreeing is good evidence.
defender tip Only test machines you are responsible for. Scanning other people's systems without permission is illegal in many places.
Without nc
curl tests web services and prints the status code. Bash can open a TCP connection itself when no tools are installed.
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8081/ 200 timeout 2 bash -c '</dev/tcp/127.0.0.1/22' && echo open open
you should see 200 from the status service and port 22 open.
What a defender takes away
- 1nc -zv tests one port.
- 2Refused means closed, a timeout often means filtered.
- 3Confirm what ss says from the client side.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.