TCP IP Network Ports
Updated October 10, 2002
Created October 10, 2002


Autogenerated Site Map
Search this Site!:
Search this site powered by FreeFind

There are some 65,000 network ports that each IP address can communicate on.

Let's say we have sendmail listening on port 25, but we have a client trying to send us mail on port 30, sendmail will never get the info. If the client tries to send us mail on port 25, then sendmail will acknowledge the message and will process the mail.

Well known ports are listed in /etc/services. Take a look at that file on your system. Try to find the important services such as ftp, ssh, telnet, netbios, smtp, imap, pop3, http, snmp, etc.

When a client starts communicating with a server service, it starts out on the well known port number for that service. Often the server service may "move" that "conversation" to a higher set of port numbers, sometimes the reason for this is to free up the "Well Known Port" for other incoming messages -- sometimes it isn't necessary to "move" the "conversation". When a "conversation" gets "moved", it is generally to a place above 1024, often it is around 32000 or higher. Ftp is one such service that often "moves the conversation" once the conversation gets started.

Port numbers are important for firewalling. How a firewall works is that it should block all 65000 ports and then open up only the ports you need. So if you need to browse the web, then it should allow "outbound" traffic on port 80. If you would like DNS lookups to work for you then you would need to open up port 53 for "outbound" traffic. If you want to access your internet mail server through pop3, then you would open up port 110 for outbound traffic. Notice that firewalls are "directional", they pay attention to where the traffic originates, thus "inbound" and "outbound". Quite frequently you will not want any "unsolicited" inbound traffic unless you have specific reasons (such as you have a web server you want people to have access to - but then again, that should probably be "outside" your firewall too and not on your internal network or "behind" the firewall -- also known as inside the firewall).

These port numbers that I listed, 80, 53, 110, again are listed in /etc/services along with their common name (http, dns, pop3).

Notice that a firewall, gateway, and router are all just about the same thing. A "gateway" is a "go-between" it allows messages to enter one side of the gateway and flow through and finally exit the other side (to a 2nd network usually). Often the gateway does something to the traffic that flows through it. Often a gateway will prevent such things as DHCP requests and responses from crossing it which provides some sort of separation. A firewall is basically the same thing as a gateway; however, it is usually a lot more configurable and can be a lot more restrictive than a gateway. A router behaves the same way as a gateway or a firewall; however, a router often communicates with more than 2 separate networks at a time, where a gateway or firewall often only deal with 2 separate networks -- internal (private) and external (public).

Again, if a service isn't listening on a port where a message comes in, then the message gets lost.

Also, xinetd will be responsible for listening to several ports at once and will then start appropriate services when messages for those services come in.



Search this Site!:
Search this site powered by FreeFind

Homepage: http://www.cpqlinux.com
Site Map: http://www.cpqlinux.com/sitemap.html