Ports and Services

Ports: many services, one machine

A single machine runs many network services at once — a web server, a database, SSH. Each one listens on a numbered port, so an address plus a port picks exactly one service. Web servers use port 80 (or 8080), SSH uses 22. ss -tulpn lists what's listening here:

ss -tulpn

In the terminal

student@vulntech:~$ ss -tulpn
Netid  State  Recv-Q  Send-Q   Local Address:Port   Peer Address:Port  Process

-t TCP, -u UDP, -l listening, -p the program, -n numeric ports. On a fresh machine the list is short.

Running a server, reaching it with curl

Start a tiny web server with busybox httpd on port 8080, serving one page. Then ss shows it listening, and curl — a client that speaks HTTP — fetches the page from 127.0.0.1:

echo "<h1>Ahoy</h1>" | sudo tee /srv/index.html
sudo busybox httpd -p 8080 -h /srv
ss -tlnp | grep 8080
curl -s http://127.0.0.1:8080/

In the terminal

student@vulntech:~$ echo "<h1>Ahoy</h1>" | sudo tee /srv/index.html
[sudo] password for student:
<h1>Ahoy</h1>
student@vulntech:~$ sudo busybox httpd -p 8080 -h /srv
student@vulntech:~$ ss -tlnp | grep 8080
LISTEN 0      9                  *:8080            *:*
student@vulntech:~$ curl -s http://127.0.0.1:8080/
<h1>Ahoy</h1>

Talking to a port by hand: nc

nc (netcat) opens a raw connection to any host and port — handy to check whether a port answers at all. Here it connects to the web server and sends a minimal request:

printf "GET / HTTP/1.0\r\n\r\n" | nc -w2 127.0.0.1 8080 | head -n 1

In the terminal

student@vulntech:~$ printf "GET / HTTP/1.0\r\n\r\n" | nc -w2 127.0.0.1 8080 | head -n 1
HTTP/1.1 200 OK

Tip: curl -I URL fetches just the headers. ss -tlnp (listening TCP) is the quick way to answer “is my service actually up and on the right port?”.

Remember: Services listen on numbered ports; ss -tulpn lists them. curl URL fetches a page as a client; nc HOST PORT opens a raw connection to test a port.