Port Status explanation

First, server port status explanation

Service side, port status change

Configure the FTP service on the native (IP address: 192.168.1.10), and then on the other computer (IP address: 192.168.1.1) to access the FTP service, from the TCPView to see the status change of the port.

1.LISTENING Status

The FTP service is first in the listening (LISTENING) state after it is started.

State is displayed as listening when it is listening, meaning that the port is open and waiting for a connection, but not yet connected. Like the door of your house is open, but no one has come in.

From the TCPView can be seen in the case of the Open FTP machine. It means: Program Inetinfo.exe open 21 port, FTP default port is 21, visible in this machine open FTP service. is currently in a listening state.

inetinfo.exe:1260 TCP 0.0.0.0:21 0.0.0.0:0 LISTENING

2.established status

Now access the 192.168.1.10 FTP service from the 192.168.1.1 computer. In the TCPView of this machine, you can see that the port status becomes established.

Established means to establish a connection. Indicates that two machines are communicating.

The following shows that the native FTP service is being accessed by the 192.168.1.1 computer.

inetinfo.exe:1260 TCP 192.168.1.10:21 192.168.1.1:3009 established

Note: A connection in the established state must be paid extra attention, as it may not be a normal connection. We're going to talk about this later on.

3. time_wait Status

Now end this computer from 192.168.1.1 to access the 192.168.1.10 FTP service. In the TCPView of this machine, you can see that the port status becomes time_wait.

Time_wait means to end this connection. Description 21 port has been visited, but the visit is over.

[System process]:0 TCP 192.168.1.10:21 192.168.1.1:3009 time_wait

4. Tips

A, you can telnet to an open port to observe the change of the port. For example, see 1025 port is open, run in command State (1 run cmd):

Telnet 192.168.1.10 1025

b, from the machine can also be tested, but the display is the native connected to the machine

C, double-click the connection in TCPView to see the location of the program, right click on the connection, select End process to end the connection.

Second, client port status explanation

Client, port status change

The client port is actually access to other computer services from the local source port, the most application is the Internet, the following to visit Baidu as an example to see the port open and state changes.

1.syn_sent Status

Syn_sent status indicates a request to connect, when you want to access the service of other computers to the first to send a synchronization signal to the port, the state is syn_sent, if the connection succeeds to become established, the Syn_sent state is very short. But if you find that syn_sent is very much and is being sent to different machines, your machine may be infected with a shock wave or a concussion. In order to infect other computers, this kind of virus will scan other computers, in the process of scanning for each computer to be scanned to make a synchronous request, which is also the cause of many syn_sent.

The following shows the local connection Baidu website when the beginning of the state, if your network is normal, it will quickly become established connection status.

IEXPLORE. exe:2928 TCP 192.168.1.10:1035 202.108.250.249:80 syn_sent

2.established status

The following shows that the machine is visiting Baidu website. If you visit the site has a lot of content such as access to Yesky, it will find an address has a lot of established, it is normal, the site of each content than slices, flash, etc. to establish a separate connection. Look at the established state must pay attention to is not IEXPLORE.EXE program (IE) initiated the connection, if it is EXPLORE.EXE and other programs initiated the connection, it may be your computer in a Trojan.

IEXPLORE. exe:3120 TCP 192.168.1.10:1045 202.108.250.249:80 established

3.time_wait Status

If the Web page is finished, it becomes time_wait state.

[System process]:0 TCP 192.168.1.10:4259 202.108.250.249:80 time_wait

Port Status explanation