Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have noticed that sometimes while trying to telnet in some random port, I have observed two kind of scenarios:

$ telnet example.com 3432
  Trying 173.252.110.27...

$ telnet example.com 3432
  Connection Refused.

Can someone explain me what is the difference between the two ?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

One reason would be the behavior of a firewall on example.com. In the event the firewall simply drops the traffic, you will see the first response. On the other hand, if the firewall rejects the traffic, you will get the second.

To better understand, take a packet filter such as tcpdump or wireshark and sniff the traffic as you perform the tests.

The first case will look like Syn,Syn,Syn...

The second case will look like Syn,Rst along with a possible ICMP port-unreachable.

A successfull connection will look like the Syn,Syn-Ack,Ack we expect in the tcp three-way handshake.

share|improve this answer
    
One doubt, so in case, if some app is not listening on some port and there is no firewall blocking the connection to that port, I should experience the second case. I mean I should get a RST TCP flag set in the reply . Am I correct ? –  pradeepchhetri Jul 7 '13 at 7:18
    
@pradeepchhetri Yes, if there is nothing either listening on or blocking traffic to a live host, you will get a connection refused error (and the associated TCP RST packet). That is really uncommon on the Internet these days, however. –  Michael Kjörling Jul 7 '13 at 8:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.