question about port comms (if Stem/Paranoid still answer N00b ??)

Discussion in 'other firewalls' started by nmaynan, Mar 9, 2008.

Thread Status:
Not open for further replies.
  1. nmaynan

    nmaynan Registered Member

    Joined:
    Mar 2, 2008
    Posts:
    98
    How exactly do comms between ports happen?

    my comp (with Online Armor) shows
    Firefox
    UDP Out 53
    TCP Out 80
    Svchost
    UDP Out 53
    UDP Out/In 123

    How come Svchost port 123 is Out/In but port 53 is just Out (If this is specific to OA, could you comment on why this is so with OA but not with another FW)?

    Like if I start firefox TCP Out 80 for a webpage, where does the reply come back to on my comp? to port 80 In? How come my OA rules don't seem to need a TCP In 80?
     
  2. MikeNash

    MikeNash Security Expert

    Joined:
    Jun 9, 2005
    Posts:
    1,654
    Location:
    Sydney, Australia
    When you connect to a website on port 80, the "80" port is at the website's end. Your computer will select a random local port to act as the endpoint.

    Since you authorised the connection, OA does not need to say "Do you want to connect to port 80 on server X, and would you like to receive the response on port X"
     
  3. nmaynan

    nmaynan Registered Member

    Joined:
    Mar 2, 2008
    Posts:
    98
    Oh, now I get it, thanks.


    What local ports act as the endpoint? Is there any pattern range to the ports? Is the local connection, for example, related to the 1024-4999 endpoint restriction (to 127.0.0.1) I add when intercepting loopback?
     
  4. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    Hi nmaynan,
    Have a look at the sticky thread for common ports used https://www.wilderssecurity.com/showthread.php?t=142036

    The local ports used for outbound can vary, but on a typical XP setup, you will see local ports 1024-5000 used, but this does depend on how many outbounds are currently in use (If you use P2P with many many connections, then higher ports than 5000 may be needed.)

    When a connection is made from your PC, lets say, you connect to this forum, you will normally see a local port (1024-5000) connected to remote port 80 (HTTP). All data for that connection is made through those ports, but, more than one connection can be made at any time, you may see 1 or 2 or 4 or ? depending on where you connect to. Once the data flow as finished the connection(s) will close.

    Typically, a program (browser etc) will start with a seemingly random local port, but will then use the next higher port for the next connection.
     
  5. nmaynan

    nmaynan Registered Member

    Joined:
    Mar 2, 2008
    Posts:
    98
    Do I have to specify 123 In and 68 In because these are system ports (as opposed to ephemeral ports)? Or does it have to do w/ the nature of the connection?

    I manually have firefox connect to internet, yet I don't specify In ports.

    If I manually update time though, I get prompted for 123 In.

    (is there a book that discusses the basics of port communication etc that you can recommend)?
     
  6. Seer

    Seer Registered Member

    Joined:
    Feb 12, 2007
    Posts:
    1,596
    Location:
    Singidunum
    This is due to nature of the connection. Port 80 (for browsers) will work over TCP where the stateful inspection is possible, so the incoming is allowed as a reply to outgoing.
    Time Service (123) and DHCP (68 ) will work over UDP protocol where SPI is unavailable (OA does not keep state table for UDP) so the incoming rules are needed.

    I don't know about the book, but stickies on this forum are quite useful. Here's a place to start reading on SPI. You can just follow subsequent links, there's a bit of reading on TCP, UDP and all kinds of networking stuff.

    Cheers,
     
  7. nmaynan

    nmaynan Registered Member

    Joined:
    Mar 2, 2008
    Posts:
    98
    Oh. I was goofed up as I was thinking the opposite. I thought OA did have a state table for UDP. I thought I read a confirmation somewhere in these forums, but I can't find it. So I'll assume OA doesn't have state table for UDP.

    Thanks Seer!

    https://www.wilderssecurity.com/showthread.php?t=191873&page=4&highlight=state table

     
    Last edited: Mar 11, 2008
Loading...
Thread Status:
Not open for further replies.