Socket Programming

TCP is a connection-oriented transport. A client that calls connect() on an IPv4 TCP socket (AF_INET + SOCK_STREAM) sends a SYN to host:port. If a process is bound and listening, the stack answers SYN-ACK and the client finishes ACK — the socket is then connected. If nothing is listening, the typical lab result on localhost is an immediate refusal (connection refused). If a firewall drops the probe, you may wait until timeout with no RST — that looks like “filtered” from here, not like a guaranteed empty port. Success means: from this process, on this machine, that destination accepted a TCP connection. It does not mean the service is safe, the banner is honest, or the host has no firewall. It does not mean you may probe the next address on the LAN.

Think of host:port as a labeled door on one building. 127.0.0.1 is the building you are standing inside — your own kernel’s loopback. Port 22 is a door number often used by SSH; port 80 by HTTP; port 1 is almost never a listener on a laptop. Walking down every door on someone else’s street is not “practice.” Walking up to door 1 on your own house and confirming it is locked is how you learn what refused versus timeout feels like. Cyberlium’s rule for this whole module: sockets and scanners aim at 127.0.0.1, localhost, or a VM IP you assigned to a guest you own. Never café Wi-Fi clients, never the ISP’s gear, never a school /24, never a random internet host “because Python can.”

Host is the destination address. In this course the host string is a constant: "127.0.0.1". Localhost as a name usually resolves to the same place; we hardcode the IPv4 loopback so you cannot accidentally pass sys.argv[1] as the café gateway. Port is a 16-bit number 1–65535 identifying a listener. Timeouts are seconds (floats are fine): s.settimeout(1.0) means “wait at most one second for connect to finish.” Without a timeout, a filtered port or a path that blackholes SYNs can block the thread until the OS gives up — often tens of seconds, sometimes until you kill the process. A teaching scanner with no timeout looks frozen. A teaching scanner with timeout=1 fails closed: you get an error, you print closed_or_filtered, you move on.

Small ranges matter as much as the host. Checking port 1 and port 59999 on loopback is a lesson. Checking ports 1–65535 on a neighbor’s printer is an attack. Checking 22, 80, 443 on a company you do not have in writing is still unauthorized access even if you “only used connect().” The API does not grant consent. Timeout plus a tiny list plus a hardcoded loopback is how beginners stay on the right side of the line while they learn errno versus success.

s.connect((host, port)) either returns None on success or raises OSError (timeout, refused, unreachable). That is correct for a client that must talk to a known service. For a yes/no “is it open?” loop, exception control-flow gets noisy. connect_ex((host, port)) returns 0 if the connect succeeded and a platform errno otherwise (for example connection refused, timed out). You still must settimeout first — connect_ex honors the socket timeout. You still must close the socket in a finally block so you do not leak descriptors if you loop. You still must not treat errno as a fingerprinting oracle for remote networks you do not own. On localhost, 0 versus not-0 is enough: open versus not open from here.

Always create the socket, set the timeout, try the connect, then close. A pattern that forgets close() will eventually hit “too many open files” if you later loop even a modest port list. A pattern that forgets timeout will hang on port 1 if a weird local filter drops instead of refusing. A pattern that takes HOST from the clipboard will one day paste a public IP. Hardcode 127.0.0.1 in the file you run for this lesson. Read the return code. Print it. That is the whole skill.

bind() + listen() + accept() is the server story: your process claims a local address and port and waits. A common teaching server is python -m http.server 8000 on YOUR machine, which binds 0.0.0.0:8000 or a local interface and accepts HTTP. That is how you later create an OPEN port on loopback for the scanner lab — you start a listener you own. connect() is the client story: you specify someone else’s (or your own) host:port and ask to be accepted. You do not bind a scanner. You do not need root to connect to a high port on localhost. You do not “open” a remote port by connecting; you only observe whether it already accepted you.

Mixing the two in your head causes bad labs. Students sometimes bind 0.0.0.0:22 as “practice SSH” on a shared box and knock everyone else off, or they connect to 192.168.1.1 because “the router is local.” The router on café Wi-Fi is not your lab VM. Loopback 127.0.0.1 never leaves your machine. A guest VM whose IP you set in VirtualBox/VMware/Hyper-V and whose network you control can be in scope if it is yours. The school DHCP pool is not. This lesson’s demo does not start a server yet; it only knocks on a door that should be shut so you feel a clean refusal.

Copy the block onto YOUR machine. Do not change HOST. Port 1 is TCP portmux historically and is almost never listening on a laptop; a high port like 59999 is also usually closed unless you bound something there. You want a refused or timed-out result so you can see connect_ex != 0. If you somehow have a listener on port 1 (rare), pick another unused high port rather than moving the host off loopback. Save a one-line result to $HOME/cyberlium-lab if you like; chmod 600. Windows: use python or py -3; chmod via Git Bash/WSL or restrict the notes file in your profile. Do not add a LAN target because the result was “too boring.” Closed on localhost is the correct lesson.

import socket

HOST = "127.0.0.1"  # hardcoded loopback — never sys.argv, never a pasted public IP
PORT = 1            # almost never a listener; try 59999 if you already bound :1
TIMEOUT = 1.0       # hang vs fail: without this, a dropped SYN can freeze the script

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(TIMEOUT)
try:
    err = s.connect_ex((HOST, PORT))

if err == 0:
        print(f"{HOST}:{PORT} OPEN (unexpected on port 1 — pick another unused port)")
    else:
        print(f"{HOST}:{PORT} closed_or_filtered connect_ex={err}")
finally:
    s.close()

mkdir -p "$HOME/cyberlium-lab" && echo "127.0.0.1:1 closed" >> "$HOME/cyberlium-lab/socket-demo.txt"
chmod 600 "$HOME/cyberlium-lab/socket-demo.txt"

You now treat a socket as host + port + protocol, TCP connect as a listening check from your vantage point, and timeout as the difference between a clean fail and a hung process. connect_ex returns 0 or an errno; bind is the server’s job. The only legal classroom target is 127.0.0.1, localhost, or a VM you control. Next — HTTP Requests (requests library) — GET and HEAD to example.com or a server you run, with timeout=, reading status and headers — never a login brute-force.