First, the port description
With the development of computer network technology, the original physical interfaces (such as keyboard, mouse, network card, graphics card and other input/output interfaces) can no longer meet the requirements of network communication. As the standard protocol of network communication, TCP/IP protocol solves this communication problem. Integrating TCP/IP protocol into the kernel of the operating system is equivalent to introducing a new input/output interface technology into the operating system, because an application program interface called "Socket" is introduced into the TCP/IP protocol. With such interface technology, computers can communicate with any computer with Socket interface through software.
Secondly, there are different ways to classify ports according to their reference objects. If classified according to the nature of ports, they can usually be divided into the following three categories:
1. Well-known ports: These ports are also commonly called "public ports". The port numbers of these ports range from 0 to 1024, and they are closely bound to some specific services. Usually, the communication of these ports clearly indicates the protocol of a service, and this port cannot be redefined. For example, port 80 is actually always used for HTTP communication, while port 23 is dedicated to Telnet service. These ports are usually not used by hackers such as Trojans. In order to let you know more about these common ports, the services corresponding to these ports will be listed in detail later in this chapter for your understanding and reference.
2. Registered port: the port number ranges from 1024 to 49 15 1. They are loosely bound to some services. In other words, many services are bound to these ports, and these ports are also used for many other purposes. Most of these ports have no clear definition of service objects, and different programs can define them according to actual needs. For example, these ports will be defined in the remote control software and Trojan horse programs introduced later. It is very necessary to remember these common program ports in the protection and killing of Trojan horses. The ports used by common Trojans will be listed in detail later.
3. Dynamic and/or dedicated ports: The port number ranges from 49 152 to 65535. Theoretically, public services should not be allocated on these ports. In fact, some special programs, especially some Trojans, like to use these ports very much, because these ports are often unknown and easy to hide.