Which door?

given
Lessons used	5.1 ports, TCP and UDP, 1.2 the OSI model
Log in	click web, dns and laptop on the Topology tab
Your answers	under the guide, in the lab app: four questions; the challenge is checked on web itself

new to this? step by stepbeginner

Click web on the Topology tab. In the web tab: ss -tln. Click dns. In the dns tab: ss -uln and ss -tln.
Click laptop. In the laptop tab: curl -s -w '\n%{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port}\n' web.lab and curl -v web.lab:22.
Fill in Your answers, under the guide.
Challenge: make curl web.lab:8080 work from the laptop.
Check task 3.3, under the guide.

Listening on a port

One computer, many doors

In lesson 5.1 the IP address was the street address, and the port was the flat number: which program on the computer a message is for. A program that offers a service tells the computer anything that arrives on this port is mine. That’s called listening.

In this lab:

Host	Program	Listens on
web	a small web server, `httpd`	?
dns	a DNS server, `dnsmasq`	?

You’ll fill in the question marks yourself, by asking each host.

`ss`: who’s listening?

ss (short for socket statistics) lists a computer’s sockets: its open doors and its conversations. The letters after it pick what to show:

Letter	Means
`t`	TCP sockets
`u`	UDP sockets
`l`	only the ones listening (waiting for someone to connect)
`n`	show port numbers, not names: `80`, not `http`

So ss -tln means TCP, listening, numbers, and ss -uln the same for UDP.

in one sentence ss -tln lists the TCP ports a computer is listening on; ss -uln the UDP ones.

Two ends of every conversation

When the laptop opens web’s page, the conversation has two sockets: web’s, on its well-known port, and the laptop’s, on a temporary port the laptop picks for this one conversation. Linux picks it from a range it keeps in a file, 32768 to 60999 unless someone changes it. Ask twice and you get two different numbers.

Open, or closed?

Try to connect to a port nobody’s listening on, and web’s own system answers straight away: nobody here. On the laptop, that’s connection refused. It’s a useful answer: the computer is there and reachable, there just isn’t a program behind that door. (A firewall that silently drops the message looks different: no answer at all, until you give up waiting.)

in one sentence Connection refused means the computer answered, but nothing listens on that port.

2 show

Reading ss and curl

On web:

web:~# ss -tln
State  Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0      9                  *:80              *:*

Part	What it means
`LISTEN`	waiting for someone to connect
`*:80`	Local Address:Port: on any of web’s addresses (`*`), port `80`
`:`	the other end: anyone, from any port. Nobody’s connected yet

(Recv-Q and Send-Q are how much is waiting to be read or sent: skip them.)

On the laptop, curl can print the two sockets of the conversation it just had. -w means write out these details when you’re done:

laptop:~# curl -s -w '\n%{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port}\n' web.lab
Hello from web.lab, 192.168.2.10

192.168.1.100:54366 -> 192.168.2.10:80

The first line is the page. The last line is the conversation: the laptop’s socket, then web’s. 54366 is the laptop’s temporary port; yours will be different.

3 follow along

Knock on the doors

Log in to web: click web on the Topology tab. In the web tab, see what it’s listening on:
run in the web tab
```
ss -tln
ss -uln
```
One TCP line, LISTEN ... *:80: that’s the web server. ss -uln prints only its heading: web has no UDP doors at all.
Now dns: click dns on the Topology tab. In the dns tab:
run in the dns tab
```
ss -uln
ss -tln
```
Port 53 in both. UDP lines say UNCONN (unconnected: UDP has no connections, so nothing to listen for); TCP lines say LISTEN. DNS answers questions over UDP, and over TCP when an answer is too big, just as lesson 5.1 said. The [::] lines are the same door for IPv6 addresses.
Click laptop on the Topology tab. In the laptop tab, open web’s page and print both sockets. Run it twice:
run in the laptop tab
```
curl -s -w '\n%{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port}\n' web.lab
curl -s -w '\n%{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port}\n' web.lab
```
web’s side is :80 both times; the laptop’s port changes. Two conversations, two temporary ports.
See the range the laptop picks from:
run in the laptop tab
```
cat /proc/sys/net/ipv4/ip_local_port_range
```
32768 60999. Both your ports are in it.
Ask DNS over TCP, to see the other door on dns working:
run in the laptop tab
```
dig +tcp web.lab
```
Same answer as in task 3.2, but the last lines say SERVER: 192.168.2.53#53(192.168.2.53) (TCP).
Knock on a door nobody’s behind: port 22, where SSH would listen. -v (verbose) makes curl say what happened:
run in the laptop tab
```
curl -v web.lab:22
```
Look for the line with failed: in it:
```
* connect to 192.168.2.10 port 22 from 192.168.1.100 port 45462 failed: Connection refused
```
web answered at once: nothing listens on 22. That line also shows the laptop’s temporary port for this try.

Fill in Your answers, under the guide, with one of your own ports from step 3:

editYour answersunder the guide

The TCP port web's web server listens on: 80
The port dns's DNS server listens on: 53
The laptop's own port, from curl's last line: 54366
One word: what curl says when you try web.lab:22: refused

in one sentence ss shows a computer’s doors from the inside; curl shows a conversation from the outside, both sockets of it.

4 challenge

A second door

Right now curl web.lab:8080 from the laptop is refused. Make it work: web should serve the same page on TCP port 8080 as well as on 80. Then click Check task 3.3, under the guide.

hint

A port only opens when a program listens on it. web’s web server is httpd, and one httpd listens on one port. You can start a second one. (You’ll do it in the web tab, not the laptop’s.)

hint

httpd --help lists its options. Two of them matter: which port to listen on, and which folder its pages are in. web’s page is in /srv/www.

show the solution

In the web tab:

web:~# httpd -p 8080 -h /srv/www
web:~# ss -tln
State  Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0      9                  *:80              *:*
LISTEN 0      9                  *:8080            *:*

-p 8080 is the port, -h /srv/www the folder. Now two doors, the same page behind each. In the laptop tab:

laptop:~# curl web.lab:8080
Hello from web.lab, 192.168.2.10

Port 8080 isn’t special: it’s simply a number people often pick for a second web server. Nothing about the page changed, only the door it comes through. That’s why a firewall that allows port 80 and nothing else would still block 8080.

Reset network, in the top bar, closes the new door again: the lab starts from how it was.

That’s the whole of Networking 101. You’ve read a host’s MAC address, IP address and prefix, watched DHCP lend an address, seen ARP and a switch’s MAC table, fixed a wrong prefix and a missing route, given a host a name, and found the port behind a service. Those are the first things an engineer checks when something won’t connect, in that order.

objective

Listening on a port

One computer, many doors

`ss`: who’s listening?

Two ends of every conversation

Open, or closed?

Reading ss and curl

Knock on the doors

A second door

5 check: run it, then prove it

objective

One computer, many doors

ss: who’s listening?

Two ends of every conversation

Open, or closed?

5 check: run it, then prove it

`ss`: who’s listening?