Rules for Determining Good vs. Bad Communications

Here is the general list of rules follow for determining good versus bad communications (As far as networking goes, at least!):

1. Memorize a bunch of known ports for common TCP/IP applications. The next section in this tutorial will get you started.
2. Learn how to use NETSTAT to see what's happening on your computer. Learn to use switches such as -a, -n, and -o to help you define what you're looking for.
3. Take the time to learn the ports that normally run on your operating system. When you see a connection using ports you don't recognize, figure out the process running the connection using a utility such as Linux's ps or Process Explorer for Windows.
4. Take the time to learn the processes that normally run on your operating system. Most operating systems have their own internal programs (such as Windows SVCHOST.EXE) that are normal and important processes.
5. When you see a process you don't recognize, just enter the filename of the process in a Web search. There are hundreds of Web sites dedicated to researching mystery processes that will tell you what the process does.
6. Get rid of bad processes.