Step 34. Ports and Services — Room Numbers Inside the Building
Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time: 3 hours
Prerequisites: Steps 31–33 (IP, ARP, DNS) complete. Work in Windows PowerShell. The only targets of connection tests are your own computer and your own gateway.
- What you need: a Windows PC, PowerShell.
- Caution: Only lookups and connection tests against your own equipment. Do not probe addresses that aren’t your equipment with
Test-NetConnection— probing ports against someone else’s target can be seen as preparation for intrusion.
In the previous chapters we learned addresses (IP). But one question remains. If a single server runs a web service, accepts remote access, and sends and receives mail — which department should an incoming letter be delivered to? Computers solve this problem with one more number.
If an IP is a building’s address, a port is the room number inside that building. Writing 172.30.1.54:22 means "room 22 of the building at 172.30.1.54." These numbers are a worldwide convention, so just by seeing which numbers are open you can guess which departments live in that building. Today you learn that language.
1. Learning Objectives
By the end of this chapter, you will be able to:
- Explain what a port is and how it differs from an IP (building and room number)
- Recite 15 major well-known ports along with their numbers
- Find and read your computer’s LISTENING ports with
netstat -an - Find the owner of an open port through the three-step chain "port → PID → program"
- Explain the security difference between something open on
0.0.0.0and something open only on127.0.0.1
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/environment | PowerShell 5.1 (mostly lookups; normal privileges are enough) |
| Today’s commands | netstat -an (list of open doors), netstat -ano (including PID), tasklist (find a name by PID), Test-NetConnection address -Port number (knock on a door) |
| Concepts needed | Port numbers and the three zones, LISTENING/ESTABLISHED, binding address (0.0.0.0 vs 127.0.0.1), banners |
2-1. The Range of Port Numbers and the Three Zones
Port numbers run from 0 to 65535 — 65,536 in total (because they’re 16-bit). They are broadly divided into three zones.
- 0–1023 (well-known): numbers of the world’s officially recognized departments. Famous services like web, mail, and SSH live here by agreement.
- 1024–49151 (registered): numbers used by registered programs. Things like databases (3306, 5432).
- 49152–65535 (dynamic): temporary numbers. Numbers your computer borrows briefly when it initiates a connection outward.
2-2. The 15 You Must Memorize
These are the regular numbers that security practitioners recognize by sight. Today you memorize this whole table.
| Port | Service | One-line description |
|---|---|---|
| 21 | FTP | File transfer (legacy, no encryption) |
| 22 | SSH | Encrypted remote access (Step 29) |
| 23 | Telnet | Remote access (plaintext — effectively forbidden these days) |
| 25 | SMTP | Sending mail |
| 53 | DNS | Name lookup (Step 33) |
| 80 | HTTP | Web without encryption |
| 110 | POP3 | Fetching mail (legacy) |
| 143 | IMAP | Reading mail (kept on the server) |
| 443 | HTTPS | Encrypted web |
| 445 | SMB | Windows file sharing |
| 3306 | MySQL | Database |
| 3389 | RDP | Windows Remote Desktop |
| 5432 | PostgreSQL | Database |
| 6379 | Redis | In-memory DB |
| 8080 | HTTP alternate | The side door for web services |
Memorization tip: bundle them into chunks. "Remote access is 22 (23 is the dangerous legacy)," "web is 80 and 443," "mail is 25, 110, 143," "databases are 3306, 5432, 6379." Memorized in bundles, they stick quickly.
2-3. LISTENING and ESTABLISHED — The Two States of a Door
Even open doors have states.
- LISTENING: "waiting for a guest." The service has opened the port and is waiting for connections. A scan reporting "open" means it saw this.
- ESTABLISHED: "on a call right now." A connection is actually established and data is flowing.
The first question of an inspection is "what is waiting for guests?" So today we focus on LISTENING.
2-4. 0.0.0.0 and 127.0.0.1 — Who Did You Open It To?
Even for the same "open," which address it’s open on makes a world of difference.
0.0.0.0:445— "I’ll accept connections to port 445 arriving at any address of this computer." It can be knocked on from beyond the neighborhood.127.0.0.1:5000— "I’ll accept only connections arriving at myself (loopback)." There’s no way to knock from outside.
"A port is open" and "it’s exposed to the outside" are different sentences. This distinction is the starting point of firewalls and security configuration.
2-5. Banners — The Voice You Hear When You Knock
Some services utter a greeting the moment you connect. This is called a banner. Connect to an SSH server and it first sends a string like SSH-2.0-OpenSSH_…. A friendly greeting — but at the same time a billboard announcing "which program, which version."
To an attacker, a banner is "the target’s version info = a list of known vulnerabilities"; to a defender, it’s "information I’m advertising about myself." You’ll actually hear one in section 3-5.
3. Follow Along
3-1. Seeing My Computer’s Open Doors — netstat
netstat -an | findstr LISTENING
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING
TCP 127.0.0.1:10086 0.0.0.0:0 LISTENING
TCP 127.0.0.1:54525 0.0.0.0:0 LISTENING
TCP 172.30.1.54:139 0.0.0.0:0 LISTENING
(Measured 2026-09-09. The real output is much longer than this, and your list will differ.)
How to read the output: each line is one "open door." The address:port at the front is "where it’s waiting," and LISTENING means "waiting for a guest."
Practice reading the measured list:
0.0.0.0:22— An SSH server is waiting on all addresses. This computer had the OpenSSH server for Windows turned on.0.0.0.0:445— Windows file sharing (SMB). You can see a number you memorized from the table.0.0.0.0:49664~— large numbers above 49152. The dynamic zone used by Windows system services.127.0.0.1:…— doors open only to myself. They can’t be knocked on from outside.
You’ll see 445 in your list too. If there’s a number you don’t know, search it — "asking what port this is" is the start of an inspection.
3-2. Finding the Doorman’s Identity — Port → PID → Program
Let’s find who owns an open port. Add the -o option and the PID (process number — that number from Step 13) appears.
netstat -ano | findstr LISTENING | findstr :445
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
(Measured 2026-09-09.)
The last number, 4, is the PID. Now ask who owns that number:
tasklist /FI "PID eq 4"
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System 4 Services 0 128 K
(Measured 2026-09-09.)
How to read it: file sharing (445) belongs to PID 4 — Windows’ System process, the heart of the operating system itself. Check port 135 the same way and the PID comes back as svchost.exe (1924) (measured 2026-09-09) — the host process for Windows services.
Port → PID → program — this three-step chain is the standard procedure for investigating "unknown ports." If a scan tells you "what is open," this procedure tells you "who opened it."
3-3. Knocking on a Door — Test-NetConnection
Now let’s knock to see whether the door really answers. The target is my gateway.
Test-NetConnection 172.30.1.254 -Port 80
ComputerName : 172.30.1.254
RemoteAddress : 172.30.1.254
RemotePort : 80
InterfaceAlias : Ethernet
SourceAddress : 172.30.1.54
TcpTestSucceeded : True
(Measured 2026-09-09. Replace the address with your own gateway.)
How to read the output: TcpTestSucceeded : True — "we knocked on door 80 and it answered." It means the router’s web admin page (port 80) was open. SourceAddress also shows which of my addresses the connection left from.
3-4. Confirming the Silence of a Closed Door
This time, knock on a room number that doesn’t exist. Port 65000 on my computer — a number no service has ever opened.
Test-NetConnection 127.0.0.1 -Port 65000
WARNING: TCP connect to (127.0.0.1 : 65000) failed
ComputerName : 127.0.0.1
RemoteAddress : 127.0.0.1
RemotePort : 65000
PingSucceeded : True
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded : False
(Measured 2026-09-09.)
How to read the output: PingSucceeded : True (the building exists, but) + TcpTestSucceeded : False (that room doesn’t exist). "I got as far as the building, but that room is closed" is split into two lines. The silence of a closed door is also information — because you can learn separately whether the other side is alive and whether a service exists.
3-5. Listening to a Banner
In 3-1 we saw that this computer has an SSH server (port 22) open. Let’s knock and hear how it greets us. Using a one-line PowerShell connection tool, connect and read the first line the server sends:
$c = New-Object System.Net.Sockets.TcpClient("127.0.0.1", 22)
$r = New-Object System.IO.StreamReader($c.GetStream())
$r.ReadLine() # the line the server sends first
$c.Close()
SSH-2.0-OpenSSH_for_Windows_9.5
(Measured 2026-09-09.)
How to read it: that one line is the banner. The server is announcing on its own, "I’m OpenSSH 9.5 for Windows." Just by connecting — before it even asks for a password — it reveals its version.
Why: to an attacker, that one line is "the target’s version." Know the version and you can unfold the list of that version’s known weaknesses. That’s why defenders configure services to hide versions, or open only the services that are truly needed.
3-6. Sorting Out the Relationship Between "Open" and "Service"
What does "closing a port" actually do? It doesn’t put a padlock on the door itself. It stops the service (the program) that was waiting for guests in that room. When a service stands up, the door opens; when it stops, the door closes — the relationship of a body and its shadow.
So when you find "an unknown port open," the action sequence is: ① find the owner program with the three-step chain from section 3-2, ② if it’s not needed, stop that service, ③ disable it so it doesn’t start automatically at boot. The precise expression is not closing the door but laying off the doorman.
4. Missions & Exercises
Mission — Build an Exposure Inspection Sheet for My Computer
- Run
netstat -an | findstr LISTENINGand paste it intomy-open-ports.txt - Pick only the ports open on
0.0.0.0, and annotate each with "what service it is" (search any number you don’t know) - Pick one of them and find its owner via the port → PID → program three-step chain, and record it
- Count and write down how many ports are open only on
127.0.0.1 - On the last line, answer yourself: "Among these, the port with no reason to be open to the outside is ___"
Exercises
Q1. Looking at a scan result saying "ports 22, 80, 443, and 3306 are open on the target server," write three sentences guessing this server’s role.
Q2. On the server, 3306 is LISTENING, but other PCs can’t connect. Name two candidate causes and how to check each.
Q3. What is the last number in netstat -ano output, and what can you do next with that number?
Q4. Give two reasons a developer opens a test web server on port 8080 instead of 80. (Hint: the rule for 0–1023, and when one computer has two web services)
5. Model Answers & Completion Criteria
Mission Model Answer
Example inspection sheet from the measured computer (2026-09-09, excerpt):
[Ports open on 0.0.0.0 and their identities]
22 → SSH (sshd.exe, PID 6416 confirmed — the remote access server I turned on)
135 → Windows RPC (svchost.exe, PID 1924 — system default)
445 → File sharing SMB (System, PID 4 — system default)
5040 → Windows default service (CDPSvc family)
5357 → Windows network discovery (WSD)
49664~49670 → Windows system services (dynamic zone)
[Ports open only on 127.0.0.1] 14 — not exposure, since they can't be knocked from outside
[Sample self-answer]
"Among these, the port with no reason to be open to the outside: 445 if I don't use file sharing.
After checking, I do use SSH (22), so I keep it; I'll check whether 445 is in use."
How to verify: ① Does every number in the 0.0.0.0 list have its identity written? ② Are the three values of the three-step chain (port, PID, program name) recorded as one set? ③ Is there a self-answer on the last line — there’s no single right answer; a judgment with grounds is enough.
Exercise Solutions
Q1 solution. Example: "It looks like a web server (80/443) that an administrator connects to and manages via SSH (22). With a MySQL database (3306) attached behind it, it’s a typical web application server. However, 3306 being open to the outside is a warning sign — databases are usually used only inside the same building." The picture the numbers paint is exactly this.
Q2 solution. Candidate ① It’s open only on 127.0.0.1 — check the address part of the LISTENING line on the server (if it’s 127.0.0.1 rather than 0.0.0.0, outside connections are impossible by design). Candidate ② A firewall is blocking it — run Test-NetConnection serveraddress -Port 3306 from another PC and check the firewall rules on the server side. "Open" and "reachable" are two separate stages.
Q3 solution. It’s the PID (process number). With tasklist /FI "PID eq number" you can find the program name behind that number. This is the "find the owner of an unknown port" procedure.
Q4 solution. ① Ports 0–1023 are precious numbers requiring administrator privileges, so testing without privileges uses 1024 or above. ② If one computer has two or more web services, they can’t share the same room number, so the numbers are split. "The agreed number is a default, not a law" — services can move house, which is why a scan doesn’t end with only the famous numbers.
Completion Criteria Checklist
- [ ] I can explain the relationship between IP and port (building and room number)
- [ ] I can recite the 15 major ports along with their numbers
- [ ] I can extract only the waiting doors with
netstat -an | findstr LISTENING - [ ] I can explain the difference between 0.0.0.0 and 127.0.0.1
- [ ] I performed the port → PID → program three-step chain myself
- [ ] I can explain what a banner is and why it’s security information
- [ ] Mission: I completed the
my-open-ports.txtinspection sheet
6. Common Pitfalls & Fixes
Wall 1. "There are so many netstat results, I don’t know what to look at."
Symptom: dozens of lines pour out and you give up reading (even the measured computer produced over 60 lines).
Cause: because ESTABLISHED, TIME_WAIT, and every other state are mixed in besides LISTENING.
Fix: today, extract only the "waiting doors" with findstr LISTENING. The first question of an inspection — "what is waiting for guests?" — is enough.
Wall 2. "Test-NetConnection throws a strange warning."
Symptom: knocking on a closed port shows a line like this (measured 2026-09-09):
WARNING: TCP connect to (127.0.0.1 : 65000) failed
Cause: it’s not an error but a result report. It means "we tried to connect and it failed," which is why the result table’s TcpTestSucceeded is False.
Fix: read the warning and the table together. PingSucceeded : True + TcpTestSucceeded : False = "the building exists but that room is closed." False is valuable information too.
Wall 3. "Lots of ports above 49152 are open. Have I been hacked?"
Symptom: several large numbers like 49664 show up as LISTENING.
Cause: mostly normal. They’re numbers in the dynamic zone used by Windows system services (the measured computer also had 49664–49670, and their owners were all Windows’ own services).
Fix: calmly check the owners — find the PID with the three-step chain (section 3-2), and if System or svchost.exe comes back, it’s in the normal category. The criterion for suspicion is not "the number is big" but "I can’t explain the owner."
Wall 4. "The port is open but I can’t connect."
Symptom: it shows LISTENING on the server, but connecting from another PC fails.
Cause: either it’s open only on 127.0.0.1, or a firewall is blocking it.
Fix: check the open address first (0.0.0.0 or 127.0.0.1). Then the firewall. "Open" and "reachable" are two separate stages.
Wall 5. "It’s 8080 — why not 80? What’s the difference?"
Symptom: you encounter a web service running on 8080 instead of 80.
Cause: ports 0–1023 are precious numbers requiring administrator privileges, so development and test web servers commonly open on 8080. Also, if one computer has two or more web services, the numbers must be split.
Fix: connecting with :8080 appended after the address is normal.
7. Summary
Today’s Concepts
| Concept | One-line description |
|---|---|
| Port | A room number inside one computer (0–65535) |
| Well-known ports | 0–1023 — the agreed numbers of the world’s official services |
| LISTENING | An open door waiting for guests |
| ESTABLISHED | A connection in the middle of a call |
| 0.0.0.0 vs 127.0.0.1 | Open to everyone vs open only to myself |
| Banner | The version greeting a service reveals immediately on connection |
| Three-step chain | Port → PID → program, the procedure for finding a port’s owner |
Today’s Commands
| Command | What it does |
|---|---|
netstat -an | findstr LISTENING |
List of waiting doors |
netstat -ano | findstr LISTENING |
List including PIDs |
tasklist /FI "PID eq number" |
Find a program name by PID |
Test-NetConnection address -Port number |
Knock on a door (your own equipment only) |
The Instinct That Matters More Than Commands
An open port is "a feature you can use," but at the same time it’s "a menu visible to attackers." Attackers read that menu and choose where to strike first. The fewer the menu items, the fewer the attacker’s options — which is why close the doors you don’t use is the first principle of server management.
And this map is not finished by drawing it once. Install a program and a door opens; sometimes a door is open that you don’t remember installing. Make today’s netstat the first page of a habit. "Eyes that see the doors currently open on my computer" — that is the line separating yesterday’s you from today’s.
Once every box is checked, Step 34 is complete. Click the checkbox in the sidebar to save your progress.