How to view opened ports

Currently, the most common Trojan Horse is based on the TCP/UDP protocol for communication between the client and the server. Since the two protocols are used, it is inevitable to open the listening port on the server side (that is, the machine where the trojan is planted) to wait for the connection. For example, the monitoring port used by the famous glaciers is 7626, And the Back Orifice 2000 is 54320. Then, we can check whether a trojan or other hacker program has been planted by checking the port opened on the local machine. The following describes the methods in detail.

　　1. netstat commands provided by Windows

For the netstat command, let's take a look at the introduction in the windows Help file:

Netstat

Displays protocol statistics and current TCP/IP network connections. This command can be used only after the TCP/IP protocol is installed.

Netstat [-a] [-e] [-n] [-s] [-p protocol] [-r] [interval]

Parameters

-A-display all connection and listening ports. Server connections are usually not displayed.

-E-display Ethernet statistics. This parameter can be used with the-s option.

-N-display the address and port number in numeric format (instead of trying to find the name ).

-S-displays statistics for each protocol. By default, statistics on TCP, UDP, ICMP, and IP are displayed. The-p option can be used to specify the default subset.

-P protocol-display the connection of the protocol specified by protocol; protocol can be tcp or udp. If you use the-s option together to display statistics for each protocol, the protocol can be tcp, udp, icmp, or ip.

-R-display the content of the route table.

Interval

Resend the selected statistics and pause interval seconds between each display. Press CTRL + B to stop resending statistics. If this parameter is omitted, netstat prints the current configuration information once.

Now, after reading these help files, we should understand how to use the netstat command. Now let's learn how to use it. Use this command to check the ports opened on your machine. Go to the command line and use the parameters a and n of the netstat command:

C:> netstat-

Active Connections

Proto Local Address Foreign Address State

TCP 0.0.0.0: 80 0.0.0.0: 0 LISTENING

TCP 0.0.0.0: 21 0.0.0.0: 0 LISTENING

TCP 0.0.0.0: 7626 0.0.0.0: 0 LISTENING

UDP 0.0.0.0: 445 0.0.0.0: 0

UDP 0.0.0.0: 1046 0.0.0.0: 0

UDP 0.0.0.0: 1047 0.0.0.0: 0

To explain, Active Connections refers to the Active connection of the current Local machine, and Proto refers to the protocol name used for the connection. Local Address is the IP Address of the Local Computer and the port number being used for the connection, foreign Address is the IP Address and port number of the remote computer connected to this port, and the State indicates the TCP connection status. You can see that the listening ports of the next three rows are UDP, so there is no State. Look! Port 7626 of my machine is open and listening is waiting for connection. In this case, it is very likely that it has been infected with glaciers! It is correct to quickly disconnect the network and Use anti-virus software to kill viruses.