Safe networks
Every program that listens on the network is a door. This lesson shows you how to see which doors are open on your computer, who can reach each one, and how to close them when you are done. Then it covers the habits that keep you safe on networks you do not control.
A listening port is a door
A server program listens on a port, a number from 1 to 65535 that tells the computer which program a connection is for. A mock API might listen on port 8080, SSH on port 22. The Networking track explains addresses and ports in depth.
What matters for security is the address the program listens on, because that decides who can knock:
| Listens on | Who can connect |
|---|---|
127.0.0.1 (or [::1]) | Only programs on this computer. Also called localhost or loopback |
192.168.1.20 (one network card's address) | Devices that can reach that network |
0.0.0.0, [::] or * | Every network the computer is on: your home Wi-Fi, the café Wi-Fi, a VPN |
0.0.0.0 means "all addresses on this machine". It is convenient, because a phone on your Wi-Fi can reach the server, and it is exactly why it needs care.
See your open doors: ss -tln
On Linux, ss -tln lists the TCP ports that something is listening on:
-tTCP only-llistening sockets only-nshow numbers instead of names
ss -tlnState Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 4096 0.0.0.0:22 0.0.0.0:*
LISTEN 0 4096 127.0.0.1:631 0.0.0.0:*
LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:*
LISTEN 0 5 127.0.0.1:8765 0.0.0.0:*
LISTEN 0 4096 [::]:22 [::]:*
LISTEN 0 511 *:4173 *:*Read the Local Address:Port column:
| Line | Meaning |
|---|---|
0.0.0.0:22 and [::]:22 | An SSH server, reachable from every network, on IPv4 and IPv6. Fine if you meant to run one; a surprise if you did not |
127.0.0.1:631 | The printing service, local only |
127.0.0.53%lo:53 | The local DNS helper, local only |
127.0.0.1:8765 | A test web server started with python3 -m http.server 8765 --bind 127.0.0.1. Local only |
*:4173 | A development server reachable from every network |
To see which program owns each port, add -p: ss -tlnp. Without administrator rights it shows only your own programs, which are the ones you are most likely to have forgotten.
The same server, two ways
Python's built-in web server shows the difference clearly. Its --bind option sets the address, and its default is all interfaces:
python3 -m http.server 8000 # listens on every network
python3 -m http.server 8000 --bind 127.0.0.1 # only this computerMany development tools work the same way: some default to localhost, others to all interfaces, and a --host or --bind option changes it. When you only need to test in your own browser, choose 127.0.0.1.
LAN sharing versus a public tunnel
Sometimes you want another device to reach your server: a phone testing your app, a teammate in the same room. There are two very different ways:
LAN SHARING PUBLIC TUNNEL
┌───────── your Wi-Fi ─────────┐ the whole internet
│ │ │
│ phone ──► 192.168.1.20:8080 │ https://random-name.example
│ (your computer) │ │
│ │ tunnel service
└──────────────────────────────┘ │
reachable by devices on your computer:8080
the same network reachable by ANYONE
who has the addressMock Studio shows both. While a project's server runs, it listens on all of the computer's network connections, so devices on the same network can reach it at the LAN address. Its Public internet (tunnel) card goes further: it starts cloudflared or ngrok and gives the mock a temporary public https:// address. Anyone who has that address can call every enabled endpoint, with no login, for as long as the tunnel runs.
Before you start a tunnel:
- keep real secrets, tokens and personal data out of the mock's responses;
- remember that a random-looking address is not a password: it can be shared, logged or guessed;
- select Stop tunnel as soon as you are done.
See Share on LAN or the internet for every step and warning.
SSH tunnels follow the same rule. In SecureShell Go, a tunnel listens on 127.0.0.1 by default, so only your own device can use it; turning on Allow other devices to use it binds it to every interface.
ADB over Wi-Fi
Android's debugging bridge, ADB, can control a phone completely: install apps, read files, see the screen. Over a USB cable, the cable proves the computer is yours. Over Wi-Fi, there is no cable.
- Android 11 and newer use Wireless debugging with a six-digit pairing code, so only a computer you paired can connect.
- Android 10 and older use the older method: the phone listens on port 5555 with no pairing. DroidDeck shows the warning under the button: TCP debugging stays open on the device until reverted, and anyone on the same network can try to connect.
The habit: turn wireless debugging off when you finish, use Revert to USB in DroidDeck after the old method, and never leave either on in a café or shared office. See Wireless debugging in the Android track.
Public Wi-Fi habits
On a network you do not control (café, hotel, airport, conference), assume someone may be watching or impersonating it.
| Habit | Why |
|---|---|
Use https:// sites; heed browser certificate warnings | HTTPS encrypts the content and proves the site's identity. A certificate warning on a public network can mean someone is in the middle |
| Mark the network as Public when the system asks | Windows and other systems then block sharing and incoming connections |
| Stop local servers, file sharing and wireless debugging | A server on 0.0.0.0 is reachable by everyone on that Wi-Fi |
| Check the network name with staff | A fake hotspot can copy a real name |
| Use your phone's hotspot or a VPN for sensitive work | Your traffic then crosses a network you trust |
HTTPS protects what you send, but the network can still see which sites you connect to. A VPN moves that view to the VPN provider, so choose one you trust.
SSH host keys: is this really my server?
When you connect with SSH, the server proves its identity with its host key. Your client remembers the key the first time and checks it on every later connection. If someone on the network pretends to be your server (a machine-in-the-middle), they cannot produce the real key, and the check fails.
A host key is shown as a fingerprint, a short code computed from the key. On the server's own console, the owner can print it:
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub256 SHA256:AK3MSlrTZ5dnlfzX4S7w6HuTUCUk8Pm+OJG0+q5D52o root@server (ED25519)Compare that with what your client shows on the first connection, character by character. In SecureShell Go, that is the Unknown host dialog; you tap Accept & save only when they match.
If a key you trusted later changes, SecureShell Go blocks the connection with Host key has CHANGED. It might be innocent (the server was rebuilt), or it might be an attack. Tap Abort connection, ask the server's owner, and trust the new key only after you have checked its fingerprint from a source you trust. Never accept an unchecked fingerprint on public Wi-Fi.
Stay safe
- Run
ss -tlnnow and then. Every0.0.0.0,[::]or*line should be something you meant to run. - Prefer
127.0.0.1for anything only you need. Stop servers and tunnels when you finish. - Public tunnels are for test data only, and only while you need them.
- Turn off wireless debugging and sharing on networks you do not control.
- Treat a changed host key or a certificate warning as an attack until you know otherwise.
Check yourself
Question 1 of 6
A server listens on 127.0.0.1:8000. Who can connect to it?
What you learned
- The listening address decides who can connect:
127.0.0.1is this computer only,0.0.0.0is every network. ss -tlnlists the open doors;ss -tlnpadds the program that owns each.- LAN sharing reaches your network; a public tunnel reaches everyone with the address.
- Host-key fingerprints and HTTPS certificates are how you know the other end is genuine.