How can we determine from the port whether it is a virus or a trojan?

Q: How can I determine from the port whether it is a virus or a trojan?

A: ports can be divided into three categories:

1. Well Known Ports: from 0 to 1023, they are closely bound to some services. Usually the communication between these ports clearly indicates a service protocol. For example, port 80 is always HTTP Communication.

2. register the port (Registered Ports) from 1024 to 49151. They are loosely bound to some services. That is to say, many services are bound to these ports, which are also used for many other purposes. For example, many systems process dynamic ports starting from around 1024.

3. Dynamic and/or Private Ports: From 49152 to 65535. Theoretically, these ports should not be allocated to the service. In fact, machines usually allocate dynamic ports from 1024. But there are also exceptions: SUN's RPC port starts from 32768.

Generally, viruses and trojans do not use the first type, namely Port 0. But there are also exceptions. For example, the red code uses port 80. Therefore, it cannot be said in general that a port of XX must come out of viruses and Trojans. In addition, the current Trojan customization function is becoming more and more powerful. You can design communication ports at will, which also makes it difficult to identify if it is a trojan.

In fact, it is basically impossible to judge from the port, especially the bounce Trojan.