Make a connection refuse, and make another one hang, and time both

short · 35 min · Objective 2.1

Task

Observe the difference between a refused connection and a filtered one on your own machine, and record the timings -- because the speed of the failure is the evidence that distinguishes them, and it is the fastest diagnostic in domain 5.

Steps

  1. Attempt a connection to a high-numbered port on your own loopback address where nothing is listening, and record the elapsed time and the exact error in lab/transport/refused.txt.
  2. Start a simple listener on a port on your own machine, connect to it, and record the result in lab/transport/accepted.txt.
  3. Add a local firewall rule that DROPS traffic to a second unused port on your own machine, attempt a connection, and record the elapsed time and the error in lab/transport/filtered.txt.
  4. Remove the firewall rule and confirm the behaviour returns to refused, recording the confirmation in lab/transport/reverted.txt.
  5. Write lab/transport/states.csv with header state,what_came_back,elapsed_seconds,what_it_proves covering open, closed and filtered.

Verify

grep -c . lab/transport/refused.txt
grep -c . lab/transport/accepted.txt
grep -c . lab/transport/filtered.txt
grep -c . lab/transport/reverted.txt
awk -F, 'NR>1 && NF>=4 {n++} END {print n" state(s) described"}' lab/transport/states.csv
awk -F, 'NR>1 {print $3}' lab/transport/states.csv | sort -u | wc -l

All four observation files non-empty, three states described, and at least two distinct elapsed times -- because if refused and filtered took the same time, one of them was not actually in the state you thought.

Notes

Remove the firewall rule. A dropped-traffic rule left in place on your own machine is exactly the kind of leftover that produces a confusing fault weeks later, and the reverted file exists so you can prove you removed it.

This is an independent study companion for CompTIA A+ Core 1 220-1201 and is not produced by or endorsed by CompTIA.