3

I'm NOT looking for advice such as "try wireshark." I'm trying to understand what netcat is and isn't.

When I try to listen (-l) to port 80, it says "address already in use." Can netcat not listen to ports in use, the way a browser does? Or is this really a wrong understanding of how browsers work? Perhaps netcat bypasses some sharing mechanism in the operating system?

I think the answer to my question is buried in this explanation using proxies but I can't understand it. http://pankaj-k.net/weblog/2010/05/using_netcat_to_view_tcpip_tra.html

2 Answers 2

4

I'm trying to understand what netcat is and isn't.

For one thing, it isn't a sniffer.

If there's something on your machine already listening on port 80, such as a Web server, nothing else can listen on port 80 (at least not with the same local IP address as the already-listening program), because packets to port 80 received by your machine can only be sent to one program.

Packet sniffers use mechanisms different from the ones "normal" network applications, such as browsers and netcat, use; the mechanism they use depends on the OS on which you're running (libpcap/WinPcap exists to hide that detail from the application), and those mechanisms let the sniffer get copies of all packets received as raw link-layer or raw IP packets.

Can netcat not listen to ports in use, the way a browser does? Or is this really a wrong understanding of how browsers work?

Yes, it's a wrong understanding of how browsers work. A browser running on your machine isn't listening on port 80 on your machine, it's sending traffic to port 80 on the Web server machine.

1
  • Thank you very much Guy. It all makes perfect sense to me now. I really appreciate you taking the time to explain it to me in layman terms. Aug 1, 2013 at 4:46
1

following on from what guy said

a browser doesn't listen on ports in use(I don't think any client or server can, by definition, otherwise the OS wouldn't know what process, specifically what particular connection- to send the packet to). the browser finds a port not in use.

http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

not under 1024 and in fact not under 49152! so very high numbered ports. that ephemeral port range 49152–65535

if you knew basic use of netstat it'd make you more familiar with things.

Try from a cmd prompt, netstat -aon or netstat -n and look at the output.

here's an example from netstat -n

you see two columns of IPs, one local, one remote (so it won't show you whether a connection is incoming or outgoing).. an ip that relates to your computer is shown on the left hand side. look on the right hand side see the lines where the right hand side have :80 only one row in this case but typically many, now see the port on the left hand side chosen by the browser e.g. 50714

enter image description here

if you do netstat -on or -aon then, the -o gets you a column for process id, and you can see in task manager which process is which.

1
  • That's very helpful, thanks. I was not familiar with what netstat does, and lsof couldn't give this info. Nov 18, 2013 at 18:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .