I have noticed that sometimes while trying to telnet in some random port, I have observed two kind of scenarios:

$ telnet example.com 3432

$ telnet example.com 3432
  Connection Refused.

Can someone explain me what is the difference between the two ?


One reason would be the behavior of a firewall on example.com. In the event the firewall simply drops the traffic, you will see the first response. On the other hand, if the firewall rejects the traffic, you will get the second.

To better understand, take a packet filter such as tcpdump or wireshark and sniff the traffic as you perform the tests.

The first case will look like Syn,Syn,Syn...

The second case will look like Syn,Rst along with a possible ICMP port-unreachable.

A successfull connection will look like the Syn,Syn-Ack,Ack we expect in the tcp three-way handshake.

  • 2
    One doubt, so in case, if some app is not listening on some port and there is no firewall blocking the connection to that port, I should experience the second case. I mean I should get a RST TCP flag set in the reply . Am I correct ? – pradeepchhetri Jul 7 '13 at 7:18
  • 2
    @pradeepchhetri Yes, if there is nothing either listening on or blocking traffic to a live host, you will get a connection refused error (and the associated TCP RST packet). That is really uncommon on the Internet these days, however. – user Jul 7 '13 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.