Learning all them darn ports!

Okay guys, I'm still a bit green and need to be pointed in a direction...

I'm eagerly trying to learn security, and I've gotten pretty good with firewalls and other little security toys, but I just have no clue when it comes to ports. Everywhere I go, I read "block this port" and "look at that port" and of course everyone but stupid me is lightyears ahead and knows what all these ports are.

So where do I start with learning about ports? Are there any good places to go to that any of you can recommend? I know this is very fundamental and vital to fully protecting a system, so please...teach me your ways!

With humble thanks,
James

Heres a list of all know port numbers and what they are associated with.
http://www.iana.org/assignments/port-numbers

What I would suggest you do, is find the port that you are looking for on that list then go to www.google.com and do a search on what the service that runs on that port does.

Heres another site that migh be helpful.
http://www.iss.net/security_center/a...ts/default.htm

Actually, thats a pretty good site there. Just click on the port number and it takes to links that explains what that ports used for.

80 is http, 25 is mail, 6667 is normally IRC, 8080 often proxy, & blah blah... But its really the programs that use 'em that you need to worry about. As for ports each of them can be used for very little or a large number of things... deppending on which one though. You could however find 6667 and say, hey that looks like one of my users is into IRC... due to the fact that its a common port for services like that, but just by seeing that its open doesn't actually mean thats what is actually going on though... Hell you can do alot of stuff VIA: (some randomly chosen port).

Quote:

---

So where do I start with learning about ports? Are there any good places to go to that any of you can recommend?

---

If you really want to learn about networking and security I recommend you pick up a good book. Almost every security book goes over in great detail what ports do what and why you should block them/how to protect yourself. You learn the good and the bad.

Some books that I'd recommend that cover all the basics along with various operating systems are:

Hack attacks revealed . It is a couple of years old, but still has great info.

Hacking exposed . This one is updated a lot more and they have a great "hacking series" Such titles include Hacking 2000 exposed, hacking linux exposed and hacking web apps.

The hacking exposed series even offers a hackers challenge series after you have learned a bit about security to test your skills at forensics. Forensics is a whole other topic... but in security it is very important that you know both. At least you'll get the basics and the money is well worth it. You don't have to spend ages looking for what you want... it is all in front of your face.

Just minor correction Specialist, Imsure its an oversight, 21 is not mail,,,
mail is 25 outgoing 110 incoming....21 is asociated with FTP

cheers

Opps typo... ???

Bleh... whatever... I've had enought cool-aid and booz for one night.

Yeh, there are only several *key* ports you're gonna have to know.

Kurt Seifried has compiled a HUGE database of ports (I think 8,547 of them, to be exact), including general firewall rules. Check him out here: http://www.seifried.org/security/ports/

AngelicKnight,

Heres a simple overview of what ports are all about to help you get started...I recommend you follow up with reading material others have provided.

1) They are only associated with the TCP/IP protocol stack.

2) There are a maximum of 65535 available within TCP/IP stack...

3) Ports are nothing more than a fancy name for TCP/IP applications or process .

4) Ports are always associated with using either TCP or UDP transport protocols. (think of TCP and UDP as "trucks" that carry your applications)

5) Ports 0-1023 are what's referred to as well known ports. This means you cannot write your own application/socket and assign it a number within that range.

Some of the popular ports that you use every day fall within this range. They include:

20/21- FTP which uses TCP
23- Telnet which uses TCP
80-HTTP which uses TCP
53-DNS Which uses UDP
25-SMTP which uses TCP (outgoing mail)
110-POP3 which uses TCP (incoming mail)
69-DHCP which uses UDP




The last thing you need to know is:

If you have a port open or what they refer to as listening, it means you are running that application. For example if you have port 80 open, it means you are a web server and are accepting connections.

Anytime a device is running an application, meaning a port is listening, there will always be some risk/vulnerability to someone finding an exploit to compromising that system..


I hope this helped you a bit...
Good luck

cheers...

if you have ever herd of STC (Simple Tool Kit) that has quite a good application on it that tell you what ports have what service. Stc 4 is the current version.

i hope this helps

gunit0072003: Good post. Something to help visualize it is a 15min animation called "warriors of the net". It is pretty good. I think it was made by erricson a while back. It is available for free and in various quality ratings.

It is an animatation that shows what exactly happens when you click on a hyperlink. It takes all the steps that take less than seconds, and streaches them out into about 15min. It helped people in my cisco classes understand exactly what was going on.

Whoever has not seen this animation... I recommend you download it right now. It is quite large. It is about 121mb for the highest quality, 80mb for the other one.

There is a 5mb sample trailer if you want to see if this is really for you or not.

http://www.warriorsofthe.net/movie.html
Make sure your right click on a video link and save target, or it'll try to play in a media player.

A good place to find out what trojans run on certain ports so that you can see whether theres a possible secuirty breach is over at blackcode,

http://www.blackcode.com

damn I hate that place,

i2c

GRC has a service called 'Shields up!' that can probe all of your ports (I think it's limited to about 1000 ports each time, but use is unlimited and free). If any of your ports appear open, you can click on the link and it gives you a description of the software which commonly uses that port, as well as information as to why/why not you should be running it.

It's not necessarily the most technical resource, but if you're new to security it's a good place to start learning.

Heres what I reccomend. If you *REALLY* are interested in security. Setup a *nix box and have a look at the /etc/services file. That will get you fresh on the first 1024 out of 65535. :)

I wouldn't bother learning the ports in earnest. I'd go over the most common ones such as ftp, http, etc....and just keep a link handy to the iana port lists. There is enough other information to learn and keep your brain busy.

If you really want to learn security, you should get very familiar with TCP/IP.
You should understand what the 3 way handshake is, SYN, FIN, RST, ACK, ephermal ports, etc...

I would recommend learning what a port is and how they are used before trying to learn which port corresponds to a particular service.

You don't have to go too crazy.... There are some great resources on the Web that give good tutorials on TCP and IP... Here are a few for example:

http://www.pcsupportadvisor.com/TCP_...rial_page1.htm
http://www4.ulpgc.es/tutoriales/tcpip/pru/3376fm.htm
http://fringe.davesource.com/Fringe/...guages/TCP-IP/
http://www.pcnetworkadvisor.com/nasample/c04100-2.pdf


Good Luck !

I have to agree with phish on the book thing. I too am new to the whole networck security thing and got myself a copy of hacking exposed it is an excellent book for people on either side of the fence. They tell you indepth the hacks that are commonly used to get into various servers and computer types and counter measueres to avoid people from using it on you. however I must say that at some points it is rather annoying for them to say the same thing over and over again.

its all about the sevices, not the ports. learn how their used, how to use them, how to abuse them, how to make them work for you. port numbers can be changed. a list of port numbers only lists there default settings. but if you learn the services well you you cant help but remember the ports. like a phone number you call allot. its not about remembering the phone number, that just happens.

1> A port is not an application, it is a socket. It is a way to access an application. Just because an application has a port/socket, that is not the entire application.

2> As J said, don't worry about knowing all the ports. It doesn't matter. Get a copy of the IANA list. Then, if you are doing a scan and see a port open, find out what it is from the list.

3> The ports on the IANA list are INCOMMING ports. When you connect to an http server you connect to port 80, but your computer is not using port 80, it uses a randomly generated high range port number. The port on the list is just the listening port.

4> Shields up sucks. Gibson writes like he thinks he is a god. What he says is normally true, but not the complete truth. Shields up doesn't even scan UDP ports, so there is obviously something wrong with his program. Go download nmap or have a friend download it and run a scan on you. It will give you a lot better results without all the fluff of a crap site.

nmap is a great tool, easy to pick up and you can get it for windows and *nix. It does a mix of scans including tcp, udp, xmas, fin, syn, null, etc. It can read the ip's from a list file, do os recognition, do a ping sweep, and give you a guess on how hard it will be to guess the tcp sequence #'s.

It's also really easy to learn...