Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have noticed that sometimes while trying to telnet in some random port, I have observed two kind of scenarios:

$ telnet 3432

$ telnet 3432
  Connection Refused.

Can someone explain me what is the difference between the two ?

share|improve this question
up vote 7 down vote accepted

One reason would be the behavior of a firewall on In the event the firewall simply drops the traffic, you will see the first response. On the other hand, if the firewall rejects the traffic, you will get the second.

To better understand, take a packet filter such as tcpdump or wireshark and sniff the traffic as you perform the tests.

The first case will look like Syn,Syn,Syn...

The second case will look like Syn,Rst along with a possible ICMP port-unreachable.

A successfull connection will look like the Syn,Syn-Ack,Ack we expect in the tcp three-way handshake.

share|improve this answer
One doubt, so in case, if some app is not listening on some port and there is no firewall blocking the connection to that port, I should experience the second case. I mean I should get a RST TCP flag set in the reply . Am I correct ? – pradeepchhetri Jul 7 '13 at 7:18
@pradeepchhetri Yes, if there is nothing either listening on or blocking traffic to a live host, you will get a connection refused error (and the associated TCP RST packet). That is really uncommon on the Internet these days, however. – Michael Kjörling Jul 7 '13 at 8:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.