Practice (25 min)

A. See what's listening on your machine:

# Linux
ss -tulnp

# macOS
sudo lsof -iTCP -sTCP:LISTEN -n -P
netstat -an | grep LISTEN

For each one, ask: do I know what that is, and should it be reachable from the network? This is a genuinely useful security habit.

B. See your active connections:

ss -tn state established        # Linux
netstat -an | grep ESTABLISHED  # macOS

Open a few browser tabs and run it again. Watch the count grow.

C. Be a server and a client yourself — this makes ports concrete:

# Terminal 1: listen on port 9999
nc -l 9999

# Terminal 2: connect to it and type something
nc 127.0.0.1 9999
# whatever you type appears in terminal 1. You just built a chat app.

# Terminal 3: watch the connection exist
ss -tn '( sport = :9999 or dport = :9999 )'

D. Prove the binding-address rule:

# Bind to loopback only
python3 -m http.server 8000 --bind 127.0.0.1
# From this machine:      curl http://127.0.0.1:8000   -> works
# From another device:    curl http://<your-ip>:8000    -> FAILS

# Now bind to everything
python3 -m http.server 8000 --bind 0.0.0.0
# From another device: works.

E. Check whether a remote port is open:

nc -zv example.com 443        # "succeeded" or "refused"/timeout
nc -zv example.com 444        # almost certainly nothing there

Build it in Go (25 min) — the binding rules, tried for real

Three rules from this chapter cause real outages: one listener per address:port, a loopback bind only accepts loopback traffic, and the less well-known SO_REUSEPORT, which lets several sockets share one port on purpose.

//go:build linux || darwin

// bindlab: Chapter 19's binding rules, tried for real.
//
//	go run ./bindlab conflict     # two listeners on one port -> EADDRINUSE
//	go run ./bindlab reuseport    # SO_REUSEPORT: four listeners share one port
//	go run ./bindlab loopback     # 127.0.0.1 vs 0.0.0.0, and what each accepts
package main

import (
	"context"
	"errors"
	"fmt"
	"net"
	"os"
	"sync"
	"syscall"
	"time"
)

func main() {
	if len(os.Args) != 2 {
		fmt.Println("usage: bindlab conflict|reuseport|loopback")
		os.Exit(2)
	}
	switch os.Args[1] {
	case "conflict":
		conflict()
	case "reuseport":
		reusePort()
	case "loopback":
		loopback()
	}
}

func conflict() {
	a, err := net.Listen("tcp", "127.0.0.1:7300")
	if err != nil {
		fmt.Println(err)
		return
	}
	defer a.Close()
	_, err = net.Listen("tcp", "127.0.0.1:7300")
	fmt.Println("second listen:", err)
	fmt.Println("EADDRINUSE?   ", errors.Is(err, syscall.EADDRINUSE))
}

// reusePort opens four sockets on the SAME port with SO_REUSEPORT set before
// bind(). The kernel then spreads incoming connections across them -- the
// trick nginx, Envoy, and HAProxy use to scale accept() across CPU cores.
func reusePort() {
	lc := net.ListenConfig{
		Control: func(network, address string, c syscall.RawConn) error {
			var opErr error
			err := c.Control(func(fd uintptr) {
				opErr = syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_REUSEPORT, 1)
			})
			if err != nil {
				return err
			}
			return opErr
		},
	}
	counts := make([]int, 4)
	var mu sync.Mutex
	for i := range counts {
		ln, err := lc.Listen(context.Background(), "tcp", "127.0.0.1:7301")
		if err != nil {
			fmt.Println("listener", i, err)
			return
		}
		go func() {
			for {
				c, err := ln.Accept()
				if err != nil {
					return
				}
				mu.Lock()
				counts[i]++
				mu.Unlock()
				c.Close()
			}
		}()
	}
	for i := 0; i < 400; i++ {
		if c, err := net.Dial("tcp", "127.0.0.1:7301"); err == nil {
			c.Close()
		}
	}
	time.Sleep(200 * time.Millisecond)
	mu.Lock()
	defer mu.Unlock()
	fmt.Println("connections accepted per listener:", counts)
	fmt.Println("(Linux hashes each connection to one socket -> roughly even;")
	fmt.Println(" macOS/BSD semantics differ -> often all on one listener)")
}

func loopback() {
	lo, _ := net.Listen("tcp", "127.0.0.1:7302")
	all, _ := net.Listen("tcp", "0.0.0.0:7303")
	defer lo.Close()
	defer all.Close()

	// Find a non-loopback address of this machine to test "from the network".
	c, err := net.Dial("udp", "1.1.1.1:53")
	if err != nil {
		fmt.Println("no network address to test with:", err)
		return
	}
	lan := c.LocalAddr().(*net.UDPAddr).IP.String()
	c.Close()

	for _, t := range []string{"127.0.0.1:7302", lan + ":7302", "127.0.0.1:7303", lan + ":7303"} {
		conn, err := net.DialTimeout("tcp", t, time.Second)
		if err != nil {
			fmt.Printf("%-22s FAIL  %v\n", t, err)
			continue
		}
		conn.Close()
		fmt.Printf("%-22s ok\n", t)
	}
	fmt.Println("\nA socket bound to 127.0.0.1 only accepts traffic addressed to 127.0.0.1.")
	fmt.Println("No firewall rule can change that: fix the bind address, not the firewall.")
}

$ go run ./bindlab conflict
second listen: listen tcp 127.0.0.1:7300: bind: address already in use
EADDRINUSE?    true

$ go run ./bindlab loopback
127.0.0.1:7302         ok
192.168.1.2:7302       FAIL  dial tcp 192.168.1.2:7302: connect: connection refused
127.0.0.1:7303         ok
192.168.1.2:7303       ok

$ go run ./bindlab reuseport          # on Linux
connections accepted per listener: [103 105 104 88]
$ go run ./bindlab reuseport          # on macOS
connections accepted per listener: [0 0 0 400]

What to notice:

• "Refused" from your own LAN address. The 127.0.0.1 listener exists, but the connection was addressed to 192.168.1.2:7302, where nothing listens. This is the most common "works on my machine" bug in container and VM setups: the app binds 127.0.0.1 and everything outside the host gets refused. Fix the bind, not the firewall.
• ListenConfig.Control runs your code on the raw file descriptor after socket() but before bind(). That's the only moment socket options like SO_REUSEPORT can be set. This hook is how Go programs reach any socket option the net package doesn't wrap.
• The same code behaves differently on Linux and macOS. Linux load-balances new connections across SO_REUSEPORT sockets by hashing the 4-tuple. BSD-derived systems historically deliver to one socket. Always test kernel behaviour on the kernel you deploy to.

A real incident this explains: during testing for this guide, a backend bound to 127.0.0.1:8081 was killed. Instead of getting "connection refused", the clients started receiving 404s. Another program (Docker Desktop) was listening on the wildcard *:8081. The kernel gives each connection to the most specific matching listener. While the backend was alive, it was more specific. Once it died, the wildcard listener got the traffic. If you see "wrong service answered", check ss -ltnp / lsof -nP -iTCP -sTCP:LISTEN for overlapping binds.

Exercises:

1. Start python3 -m http.server 8000 --bind 0.0.0.0, then try to net.Listen("tcp", "127.0.0.1:8000") in Go. Does it conflict? (On Linux it does: a wildcard bind covers every address.)
2. Run reuseport under strace -f -e trace=setsockopt,bind,listen and find the four setsockopt(... SO_REUSEPORT ...) calls.
3. Read how Linux's Chapter 37 on network views shows these listeners with ss -ltnp, then find which process owns each.