(1) Well-known ports: These ports are also commonly called "public ports". The port numbers of these ports range from 0 to 1024, and they are closely bound to some specific services. Usually, the communication of these ports clearly indicates the protocol of a service, and this port cannot be redefined. For example, port 80 is actually always used for HTTP communication, while port 23 is dedicated to Telnet service. These ports are usually not used by hackers like Trojans. In order to let you know more about these common ports, the services corresponding to these ports will be listed in detail later in this chapter for your understanding and reference.

(2) Registered port: the port number ranges from 1025 to 49 15 1. They are loosely bound to some services. In other words, many services are bound to these ports, and these ports are also used for many other purposes. Most of these ports have no clear definition of service objects, and different programs can define them according to actual needs. For example, these ports will be defined in the remote control software and Trojan horse programs introduced later. It is very necessary to remember these common program ports in the protection and killing of Trojan horses. The ports used by common Trojans will be listed in detail later.

(3) Dynamic and/or dedicated ports: the port number ranges from 49 152 to 65535. Theoretically, public services should not be allocated on these ports. In fact, some special programs, especially some Trojans, like to use these ports very much, because these ports are often unknown and easy to hide.

According to different service modes, ports can be divided into "TCP protocol ports" and "UDP protocol ports". Because computers generally use these two communication protocols to communicate with each other. The "connection mode" mentioned above is a direct connection with the receiver. After sending the information, you can confirm whether the information has arrived. This mode mostly adopts TCP protocol. The other is to send information online without direct connection with the receiver, regardless of whether the information arrives or not, which is the "connectionless mode" introduced earlier. This way mostly adopts UDP protocol, and IP protocol is also a connectionless way. Ports provided by services using the above two communication protocols are also divided into "TCP protocol ports" and "UDP protocol ports".