Read your own machine's connections and name every service by its port

short · 35 min · Objective 2.1

Task

Turn the memorised port list into a reading skill by naming the services your own machine is talking to right now, and by finding out what it is listening on.

Steps

  1. Capture the machine's current connections to a file: netstat -an > lab/ports/connections.txt on any platform, or ss -tuna > lab/ports/connections.txt where available.
  2. Extract the distinct remote destination ports and record them with counts in lab/ports/remote.csv with header port,count,service, filling service from memory first and checking afterwards.
  3. Extract the ports the machine is LISTENING on into lab/ports/listening.csv with header port,service,expected and mark each as expected or not.
  4. For any listening port you cannot explain, record in lab/ports/unexplained.md what is bound to it and how you found out.
  5. Write lab/ports/pairs.csv with header service,plain_port,secure_port,why_plain_still_exists covering at least five secure and insecure pairs.

Verify

test -s lab/ports/connections.txt && echo "capture present"
awk -F, 'NR>1 && NF>=3 {n++} END {print n" remote port(s) named"}' lab/ports/remote.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" listening port(s)"}' lab/ports/listening.csv
awk -F, 'NR>1 && tolower($3)!="yes" {n++} END {print n+0" unexpected listener(s)"}' lab/ports/listening.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" secure/insecure pair(s)"}' lab/ports/pairs.csv

Five or more remote ports named, every listening port classified, and five or more pairs recorded. An unexpected listener is a finding about your own machine and is worth chasing down rather than deleting from the table.

Notes

Do this on a machine you own. The same command on somebody else's machine is a different activity with different rules, and this course draws that line in every lab.

This is an independent study companion for CompTIA A+ Core 1 220-1201 and is not produced by or endorsed by CompTIA.