The till that says connection refused
A port is a number that names one program on a machine, such as a web server on port 80. Reading ports and web replies tells you exactly why a connection fails.
A shop's till shows a red message: connection refused. The card machine is switched on and its cable is fine.
The message says something exact. The till reached the machine, and nothing there was waiting on that door.
By the end of this lesson
Note
I can check which ports a machine is listening on and read a web reply.
Key words
| Word | What it means | Example |
|---|---|---|
| Port | a number that names one door on a machine | 80 |
| Listening | waiting for connections on a port | |
| HTTP | the language of web requests and replies | |
| Status code | a three-digit number that says how a request went | 200 |
| Header | a line of extra information in a request or a reply |
The cells students fill in are left blank in this preview.
A port is a door on a machine
An address finds a machine. A port finds one program on it. A web server waits on port 80, and a different program waits on another.
A program that waits on a port is listening. The command ss -ltn lists every listening port: l for listening, t for TCP and n for plain numbers.
List what the LAN machine is listening on
sudo ip netns exec lan ss -ltnShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
List what the outside server is listening on
sudo ip netns exec srv ss -ltnShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Knock on a port to see who answers
From another machine, nc -zv knocks on a port and does not send anything. The z means just check, and v means say what happened.
It prints one of three results, and the table below says what each one means.
Knock on a port that is open
sudo ip netns exec gw nc -zv -w 2 10.0.0.2 80Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Knock on a port where nobody listens
sudo ip netns exec gw nc -zv -w 2 10.0.0.2 9999Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: what a knock tells you
| nc prints | What it means | Where to look |
|---|---|---|
| succeeded | A program is listening | The program itself |
| Connection refused | The machine answered and nothing listens there | Is the program running, and on which port |
| timed out | No answer came back at all | A firewall, or a route that fails |
The cells students fill in are left blank in this preview.
A web reply has three parts
A web request is plain text. The reply is plain text too, in three parts: a status code line, some headers, and then the body.
The status code says how it went. The first digit is the family. A 2 is success and a 3 is a move. A 4 is a mistake by the asker, and a 5 is a mistake by the server.
Read a whole reply, headers first
sudo ip netns exec gw curl --noproxy '*' -s -i -m 3 http://10.0.0.2/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Print only the status code
sudo ip netns exec gw curl --noproxy '*' -s -o /dev/null -w '%{http_code}\n' http://10.0.0.2:8081/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: the families of status code
| Code | Family | In plain words |
|---|---|---|
| 200 | 2xx | It worked, and here is the page |
| 301 | 3xx | It moved: ask this other address |
| 404 | 4xx | There is nothing at that path |
| 503 | 5xx | The server could not do it just now |
The cells students fill in are left blank in this preview.
Send a request by hand
printf 'GET /hello HTTP/1.0\r\n\r\n' | sudo ip netns exec gw nc -w 2 10.0.0.2 80Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think port 80 is the web and no other port can be. A port is a number somebody chose, and 80 is only the usual choice for HTTP. The outside server here speaks HTTP on port 8000. Ask what is listening, then ask it a question.
Going further: find the process
Run sudo ip netns exec lan ss -ltnp and read the last column of each line. It names the program that holds the port.
Which program is listening on port 80? Is it the same process that holds 8081? Why would that help you when a port is already taken?