Discovery 4: Inspect TCP/IP Applications

Task 1: Inspect TCP/IP Applications

Activity
Step 1: R1 has been configured to run several TCP services, including Telnet, SSH, HTTP,
and HTTPS. It has also been configured to run an NTP service. How and why these
services may be configured on a router is beyond the scope of this discovery. For now,
verify the services that are running on R1 by viewing its open ports. Access the console of
R1 and execute the show control-plane host open-ports command.
There are several open TCP ports: 22 for SSH, 23 for Telnet, 80 for HTTP, and 443 for
HTTPS; as well as UDP port 123 for NTP.
R1# show control-plane host open-ports
Active Internet connections (servers and established)
Prot Local Address Foreign Address
Service State
tcp *:22 *:0 SSH-
Server LISTEN
tcp *:23 *:0
Telnet LISTEN
tcp *:80 *:0 HTTP
CORE LISTEN
tcp *:80 *:0 HTTP
CORE LISTEN
tcp *:443 *:0 HTTP
CORE LISTEN
tcp *:443 *:0 HTTP
CORE LISTEN
udp *:123 *:0
NTP LISTEN
These ports are in a listening state; that is, no foreign addresses are connected to them, but
they are ready for connections to ensue.
Note
Both HTTP and HTTPS use TCP. In the output, you will see both as “HTTP CORE”
Service. To distinguish them, pay attention to the port numbers in the Local Address
column: HTTP uses port 80 while HTTPS uses port 443.
Step 2: Access the console of PC1 and use Telnet to connect to R1. The password for R1
is Cisco123.
Note
In this lab environment, telnet is used for connection to R1. However, you should SSH in
production environment to remotely access and manage a device.
The prompt changes from PC1 to R1 because you are now connected to R1 via Telnet from
PC1.
PC1# telnet 10.10.1.1
Trying 10.10.1.1 ... Open
User Access Verification

Password: Cisco123
R1#
Step 3: Return to the console of R1 and review the open ports. You may want to use the
Cisco IOS command recall feature to re-enter the command.
There is an extra line in the output when compared with the last execution. It shows a
second line that is associated with TCP port 23. In this case, the foreign address is
populated. The IPv4 address is 10.10.1.10 (the address of PC1). The foreign port number
might not be the same as what is shown in the example because it is an ephemeral port. An
ephemeral port is allocated automatically for a short time from a predefined range by the
IPv4 stack software.
R1# show control-plane host open-ports
Active Internet connections (servers and established)
Prot Local Address Foreign Address
Service State
tcp *:22 *:0 SSH-
Server LISTEN
tcp *:23 *:0
Telnet LISTEN
tcp *:80 *:0 HTTP
CORE LISTEN
tcp *:80 *:0 HTTP
CORE LISTEN
tcp *:443 *:0 HTTP
CORE LISTEN
tcp *:443 *:0 HTTP
CORE LISTEN
tcp *:23 10.10.1.10:14044
Telnet ESTABLIS
udp *:123 *:0
NTP LISTEN
Step 4: Access the console of PC2 and use Telnet to connect to R1. The password for R1
is Cisco123.
The prompt changes from PC2 to R1 because you are now connected to R1 via Telnet from
PC2.
PC2# telnet 10.10.1.1
Trying 10.10.1.1 ... Open

User Access Verification

Password: Cisco123
R1#
Step 5: Return to the console of R1 and review the open ports. You may want to use the
Cisco IOS command recall feature to re-enter the command.
There is an extra line in the output that shows an additional connection to TCP port 23,
while the foreign address is populated with the IPv4 address of 10.10.1.20 (the address of
PC2). The foreign port number for this connection also might not be the same as what is
shown in the example because it will be an ephemeral port. The existing connection from
PC1 is retained.
R1# show control-plane host open-ports
Active Internet connections (servers and established)
Prot Local Address Foreign Address Service
State
tcp *:22 *:0 SSH-Server
LISTEN
tcp *:23 *:0 Telnet
LISTEN
tcp *:80 *:0 HTTP CORE
LISTEN
tcp *:80 *:0 HTTP CORE
LISTEN
tcp *:443 *:0 HTTP CORE
LISTEN
tcp *:443 *:0 HTTP CORE
LISTEN
tcp *:23 10.10.1.20:15026 Telnet
ESTABLIS
tcp *:23 10.10.1.10:14044 Telnet
ESTABLIS
udp *:123 *:0 NTP
LISTEN
Step 6: Return to the console of PC1 and use the exit command to disconnect the Telnet
session to R1.
The prompt returns to PC1 because you are no longer connected to R1.
R1# exit

[Connection to 10.10.1.1 closed by foreign host]

PC1#
Alternatively, you could have used the logout command to disconnect from R1.
Step 7: Return to the console of PC2 and use the exit command to disconnect the Telnet
session to R1.
The prompt returns to PC2 because you are no longer connected to R1.
R1# exit

[Connection to 10.10.1.1 closed by foreign host]

PC2#
Alternatively, you could have used the logout command to disconnect from R1.
Step 8: Return to the console of R1 and review the open ports again.
All ports are in a listening state.
R1# show control-plane host open-ports
Active Internet connections (servers and established)
Prot Local Address Foreign Address Service
State
 tcp *:22 *:0 SSH-Server
LISTEN
tcp *:23 *:0 Telnet
LISTEN
tcp *:80 *:0 HTTP CORE
LISTEN
tcp *:80 *:0 HTTP CORE
LISTEN
tcp *:443 *:0 HTTP CORE
LISTEN
tcp *:443 *:0 HTTP CORE
LISTEN
udp *:123 *:0 NTP
LISTEN
Step 9: In the console of R1, disable the HTTP service using the no ip http
server command in global configuration mode. The web configuration service and related
commands are beyond the scope of this discovery, so for now, simply disable the HTTP
service.
The TCP port 80 for HTTP is no longer opened.
R1# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# no ip http server
R1(config)# exit
R1#
Step 10: In the console of R1, review the open ports again.
The TCP port 80 for HTTP is no longer shown in the output.
R1# show control-plane host open-ports
Active Internet connections (servers and established)
Prot Local Address Foreign Address Service
State
tcp *:22 *:0 SSH-Server
LISTEN
tcp *:23 *:0 Telnet
LISTEN
tcp *:443 *:0 HTTP CORE
LISTEN
tcp *:443 *:0 HTTP CORE
LISTEN
udp *:123 *:0 NTP
LISTEN

© 2020 Cisco Systems, Inc.