1) well-known ports: from 0 to 1023, which are closely bound with some services. Usually, the communication between these ports clearly indicates some service protocol. For example, port 80 has always been HTTP communication.

2) Registration port: from 1024 to 49 15 1. They are loosely bound to some services. In other words, many services are bound to these ports, and these ports are also used for many other purposes. For example, many systems handle a dynamic port of about 1024.

3) Dynamic and/or dedicated ports: from 49 152 to 65535. Theoretically, these ports should not be assigned to services. In fact, machines usually allocate dynamic ports from 1024. But there are exceptions: SUN's RPC port starts at 32768.

This section describes the information of TCP/UDP port scanning in firewall records. Remember: there is no such thing as an ICMP port. If you are interested in interpreting ICMP data, please refer to other parts of this article. 0 is usually used to analyze the operating system. This method is effective because "0" is an invalid port in some systems. When you try to connect it with an ordinary closed port, it will produce different results. Typical scanning: use the IP address 0.0.0.0, set the ACK bit and broadcast it in the Ethernet layer. 1 tcpmux this means that someone is looking for the SGIIrix machine. Irix is the main provider of tcpmux, which is turned on by default in this system. Iris machine contains several default password-free accounts when it is released, such as LP, Guest, UUCP, NuUCP, Demos, Tutor, Diag, EzSetup, OutofBox, 4Dgifts, etc. Many administrators forget to delete these accounts after installation. So hackers searched for tcpmux online and used these accounts. 7Echo You can see the messages sent by many people to x.x.x.0 and x.x.x.255 when searching for the Fraggle amplifier. A common DoS attack is echo-loop. The attacker forges UDP packets sent from one machine to another, and the two machines respond to these packets in the fastest way. (See Chargen) Another thing is to double-click the TCP connection established at the word port. There is a product called Resonance Global Scheduling, which connects this port of DNS and determines the nearest route. Harvest/squid cache will send UDPecho from port 3 130: "If the source_ping on option of the cache is turned on, it will send a hit reply to the UDP echo port of the original host." This will generate many such packets.

/PC base/z 30 1 166 . html

/pcbase/u292023.html

/meet windows/z 7 1 1 10404 1 . html