Workshop

printer 515 Line Printer Daemon (network printing for UNIX)
socks 1080 Socks proxy server (Socks 4 and Socks 5)
What if you don’t know the socket number of a client/server program that you’re using? Simple—stop the
server program and then run netstat -an. Print it out or save it to a file:
netstat -an > socklist.txt
Then start the server program and run netstat -an again. Compare the two lists. The new socket
number that shows up in the second list is the socket number (or numbers) for your client/server program.
Connection-Oriented Versus Connectionless Sockets
As we discussed in Hour 15, “Firewall and Proxy Server Basics,” for our purposes, there are two types of
sockets: UDP and TCP. When a program sends out a UDP packet, it has no way of knowing that the
packet got there because it’s connectionless, rather like a message in a bottle. For our troubleshooting
purposes, we hate UDP. It’s a very irresponsible child. We like TCP best, because we can quickly tell
whether a TCP socket is listening. Because a TCP socket is a connection-oriented socket, we can initiate
a call on our own and see whether we get a busy signal or a connection.
One way to check whether the socket is being established is to use the client program itself and then
check the workstation’s socket list. For example, here’s how you can connect with an FTP service in one
window and run netstat -an in another window:
C:\WINDOWS>netstat -an | find “:21”
TCP 192.168.10.5:1025 192.168.5.1:21 ESTABLISHED
Here you have an ESTABLISHED connection, so no matter how much your FTP client is complaining,
you do have a bona fide socket. In this case, you might want to look at client configuration if you’re
experiencing problems.
Another way to check whether a remote socket is listening is to telnet to that socket. For example, let’s
perform a control experiment. You can run an FTP server on a PC and then use Telnet to go to it to see if
it’s listening. Just so you don’t even go to the outside network, use your loopback address (the loopback
address in TCP/IP is always 127.0.0.1). You can see the results just by typing this (see Figure 18.5):
telnet 127.0.0.1 21