Seeing the doors that are open

Learn netstat with four marks on it, as one thing.

~ $ netstat -tulnActive Internet connections (only servers)Proto Recv-Q Send-Q Local Address  Foreign Address  Statetcp   0      0      :::8080        :::*             LISTEN

The marks mean this.

Learn -tuln as one spell of four. It is the form typed most in the field, too.

The reason for -n as well.

without -n   :::http    (it tries to turn it into a name)with -n      :::80      (it stays a number)

Turning things into names can be slow (it goes off to ask DNS). Numbers are surer and faster.

Three fields are enough to read.

Proto           tcp or udpLocal Address   which of your doorsState           how it stands now

Recv-Q and Send-Q are how much is piled up. Usually 0, and not 0 is a sign that the handling is not keeping up. Look at them only when in trouble.

The words in the State column say the state outright.

Whether there is a LISTEN is the first thing to look at.

there is a LISTEN   -> somebody is waiting (you may get in)there is none       -> nobody is waiting (you certainly cannot)

That is the surest proof of "the service is not running".

The writing of Local Address means something too.

:::8080          it takes callers from any address0.0.0.0:8080     the same thing (the IPv4 writing)127.0.0.1:8080   it takes callers only from itself!

The third matters.

waiting at 127.0.0.1:3306  |from inside the same machine you get infrom another machine you do not

This is both an accident and a design. A database is safest kept to "the same machine only". The other way round, when "it should be reachable from outside but is not", this being 127.0.0.1 is very often why.

not reachable from outside -> look at Local Address first

Remember that the address column decides whom it takes.

Go to a door nobody waits at and this comes back.

~ $ wget http://127.0.0.1:8080/wget: can't connect to remote host (127.0.0.1): Connection refused

Connection refused is the answer "there is nobody here".

Last lesson listed four messages. A fifth goes in here.

Amusing that refused is proof of arrival.

it did not arrive  -> not even an answer comesit did arrive      -> an answer comes saying "nobody here"

So when refused appears, the network is fine. Suspect their application.

refused    -> the app has fallen over / the door number is wrongno answer  -> it is dropped on the way / they are hiding

Do not mix these two. They are mended in quite different places.

Here is a mistake newcomers often make.

"I got refused. Would that be the firewall?"

An ordinary firewall throws things away in silence, so you get no answer at all. A refused means it got that far and their operating system answered.

refused appeared -> look at ps and netstat first

You check whether your own side's app is running, first.

It pays to know the famous door numbers.

The number tells you the service. And the other way round, a number open that should not be is dangerous.

There is one great boundary in the numbers.

0 to 1023      privileged ports (only root may open them)1024 to 65535  anyone may

So practice uses 8080.

~ $ httpd -p 80httpd: bind: Permission denied~ $ httpd -p 8080(it opens)

Why guard below 1024? To prevent impersonation.

if anyone could open 443?  -> they could stand up a false https server

The famous numbers carry trust. So only the administrator may open them.

8080 is much used for web practice because it looks like 80 and is easy to remember. 3000 and 5173 are common too (numbers used by development tools).

One bit of lore: a file called /etc/services sometimes holds the table of numbers against names. Drop the -n from netstat and it uses that table to turn them into names.

One command, netstat, produces several kinds of table.

The confusing part is that with or without -l you get quite a different table.

with -l      only the ones waitingwithout -l   only the ones talking-a           both

The UNIX sockets of -x are worth a look at least once.

unix  3  [ ]  DGRAM  CONNECTED  34 /dev/log

There is /dev/log. The one the logger of the last lesson was talking to.

logger -> /dev/log -> syslogd -> /var/log/messages

A path that talks inside the machine only, without going through the network. Within one machine it is faster and safer. It is used for connecting to databases as well.

-r is the same contents as the ip route of the last lesson.

netstat -r    the old wayip route      the new way

The old tool packs several faces into one. ip split them apart neatly. So if you are learning now, ip, with netstat (or ss) only for looking at doors.

There is no ss in this environment, but rewriting netstat -tuln as ss -tuln gets you almost the same, so nothing has to be learned twice.

This lesson is practice at looking, but to look, somebody has to be waiting.

So let us borrow one door-opening tool in advance.

~ $ httpd -p 8080 -h /home/learner~ $

It came back with nothing. That is not a failure.

-p 8080             open door number 8080-h /home/learner    what to show (it hands out the files in there)

It comes back at once because it goes round the back and keeps running. Like the & of chapter 8, except this one goes round the back by itself. Such a thing is called a daemon.

an ordinary command   the screen does not come back until it endsa daemon              it comes back at once and runs on behind

Whether it is running you can check with the ps of chapter 8. Stopping it is the same.

ps | grep httpd     see whether it runskillall httpd       stop it

No new tool needed. httpd in detail comes next lesson, so here we use it only as "the one who opens a door".

One promise, please.

> Shut the door you opened when the practice is over

Leaving it open is like going out with the house unlocked. In this lesson's exercises you will type the closing killall httpd many times, so that open it, shut it gets into you.

Here are the shapes for this lesson.

netstat -tuln              the doors being waited atnetstat -an                waiting plus talkingnetstat -x                 the paths inside the machinenetstat -r                 the routing tablehttpd -p 8080 -h /home/learner   open a doorkillall httpd              shut itwget -q -O - URL           knock on it

And the places to read.

LISTEN         waitingESTABLISHED    talking nowTIME_WAIT      finished talking, tidying up:::8080        takes callers from any address127.0.0.1:8080 takes callers only from itself

Three things to remember most today.

1. with no LISTEN, you certainly cannot get in2. Connection refused is proof that it arrived3. doors under 1024 may be opened only by root

And today's conclusion.

> A machine being alive and a door being open are two matters

The ping of last lesson is rung one, this lesson's netstat is rung two, and the wget of the next is rung three.

1. ping     is the machine alive?2. netstat  is the door open?3. wget     do the contents come back?

With all three, you can nearly always name where the cause is.

In the last two exercises you make a tool that watches whether a door is open and keeps it in the record. Chapter 11 and the last two lessons all join up. Let us type.