Make a connection refuse, and make another one hang, and time both

short · 35 min · Objective 2.1

Task

Observe the difference between a refused connection and a filtered one on your own machine, and record the timings -- because the speed of the failure is the evidence that distinguishes them, and it is the fastest diagnostic in domain 5.

Steps

  1. Attempt a connection to a high-numbered port on your own loopback address where nothing is listening, and record the elapsed time and the exact error in lab/transport/refused.txt. On Linux or macOS the refusal is immediate. On Windows it takes about two seconds, because the client retries after the reset before giving up -- measured at 2.0 s against 21 s for a connection nobody answers, so the contrast the lesson describes still holds. Time it with a plain socket (python3 -c with socket.create_connection), not Test-NetConnection, which adds its own ping checks and took 12.8 s to report the same refusal.
  2. Start a simple listener on a port on your own machine, connect to it, and record the result in lab/transport/accepted.txt.
  3. Add a local firewall rule that DROPS traffic to a second unused port on your own machine, attempt a connection, and record the elapsed time and the error in lab/transport/filtered.txt. On Linux, iptables -A INPUT -p tcp --dport <port> -j DROP works on loopback too. Windows Defender Firewall does not apply its rules to loopback traffic, so on Windows a block rule for 127.0.0.1 changes nothing: connect to the machine's LAN address from a second machine or a VM instead.
  4. Remove the firewall rule and confirm the behaviour returns to refused, recording the confirmation in lab/transport/reverted.txt.
  5. Write lab/transport/states.csv with header state,what_came_back,elapsed_seconds,what_it_proves covering open, closed and filtered.

Verify

These checks run in a POSIX shell: Terminal on macOS or Linux, and on Windows Git Bash (it comes with Git for Windows) or WSL. A stock Windows PowerShell or Command Prompt has no awk or grep, so there the first line fails.

grep -c . lab/transport/refused.txt
grep -c . lab/transport/accepted.txt
grep -c . lab/transport/filtered.txt
grep -c . lab/transport/reverted.txt
awk -F, 'NR>1 && NF>=4 {n++} END {print n" state(s) described"}' lab/transport/states.csv
awk -F, 'NR>1 {print $3}' lab/transport/states.csv | sort -u | wc -l

All four observation files non-empty, three states described, and at least two distinct elapsed times -- because if refused and filtered took the same time, one of them was not actually in the state you thought.

Notes

Remove the firewall rule. A dropped-traffic rule left in place on your own machine is exactly the kind of leftover that produces a confusing fault weeks later, and the reverted file exists so you can prove you removed it.

This is an independent study companion for CompTIA A+ Core 1 220-1201 and is not produced by or endorsed by CompTIA.