Last Updated: 2024-04-26

I wanted to see how my phone talked to a Rails server (on port 3000) on the same network.

Start by using netstat to monitor the TCP traffic:

$ netstat TCP

Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp4       0      0  jacks-computer.local.55405  do-11.lastpass.c.https SYN_SENT
tcp4       0      0  jacks-computer.local.hbci   honor_10-abababa.57284 ESTABLISHED
tcp4       0      0  jacks-computer.local.hbci   honor_10-abababa.57282 ESTABLISHED

• "Local Address" is my computer. It has two components — jacks.computer.local (name) and the port numbers/names (55405 in the first case, and hbci in the second - more on why the Rails server on port 300 appears as hbci later...)
• In the foreign address of the last two rows, I can see my phone (honor_10)
• (Aside) How does netstat know to put the process name hbci in? It starts by knowing its port number (3000) and then greps /etc/services and finds the matching entry in this file.

In this case:

  hbci            3000/udp    # HBCI

hbci corresponds to Home Banking Computer Interface. This has nothing to do with my Rails server - it's just what this file believes port 3000 is normally used for. By seeing how these names for port 3000 services diverge, it should hopefully be clear that one should not rely on these conversions of ports into symbolic names by netstat.

If the HTTP port is 80, why am I connected on 55969 below according to netstat?

tcp4       0    517  jacks-computer.local.55969  stackoverflow.http ESTABLISHED

Because port 80 is only for the HTTP requests on the server side. On my computer, any port can be used. Indeed Google Chrome opens a different port for each tab.