Re: Firewall shows ports being used in sqeuence

Re: Firewall shows ports being used in sqeuence

Secure Home | Search | About
 Networking Firewalls    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Re: Firewall shows ports being used in sqeuence Wolfgang Kueter 12-05-2005
Posted by Wolfgang Kueter on December 5, 2005, 3:25 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Am Mon, 05 Dec 2005 14:28:49 +0000 schrieb Alix:


> The monitor feature in the FILSECLAB firewall shows that simply to
> do their work, the browser and newsreader are accepting
> connections which come into my local ports numbered 1030, 1031,
> 1032, 1033, etc. The sequence is not precisely followed but more
> or less that is what is happening.

Read a book about TCP/IP, find about the magic formula call 'source port'
and what distinguishes that from a 'destination port' and once you've
understood that uninstall that piece of software firewall-crap.

> What could be causing this sequential use of local ports?

Normal behaivior of an avarage TCP/IP stack.

> something I might have set in XP's registry?

No, just read a good book.

Wolfgang



Posted by Alix on December 7, 2005, 1:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Mon 05 Dec 2005 20:25:44, Wolfgang Kueter

>
>> The monitor feature in the FILSECLAB firewall shows that simply
>> to do their work, the browser and newsreader are accepting
>> connections which come into my local ports numbered 1030, 1031,
>> 1032, 1033, etc. The sequence is not precisely followed but
>> more or less that is what is happening.
>
> Read a book about TCP/IP, find about the magic formula call
> 'source port' and what distinguishes that from a 'destination
> port' and once you've understood that uninstall that piece of
> software firewall-crap.

I posted the monitor from Filseclab so you could confirm that it
reads as if it is a local port which is being used in the way I
describe.

Are you saying that it is normal behavior of the TCPIP stack that
I am going out of port 80 and using those ascending port numbers
as I try to access various web and news servers?

>
>> What could be causing this sequential use of local ports?
>
> Normal behaivior of an avarage TCP/IP stack.

I am going to get a hardare firewall when I can afford to.

Posted by Wolfgang Kueter on December 7, 2005, 2:12 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Alix wrote:

> I posted the monitor from Filseclab so you could confirm that it
> reads as if it is a local port which is being used in the way I
> describe.

What you observe is plain normal behaivior.

> Are you saying that it is normal behavior of the TCPIP stack that
> I am going out of port 80 and using those ascending port numbers
> as I try to access various web and news servers?

Of course, yes. There is a difference between client and server and
destination port and source port. Both major transport protocols (which
are tcp and udp) when connecting a service on a remote machine will
contact the destination machine on the well known destination port for the
particular service (80 for web/http, 119 for news/nntp, 110 for pop3, 25
for smtp ...) and use a random source port above usually above 1024 to
recieve the answer packets from the remote machine. That is just how a
tcp/ip stack works. Ascending source port numbers are nothing to worry
about. Ascending TCP sequence numbers however would of course be a
completely different story.

Please read documents like:

http://www.firewall.cx/tcp-analysis-section-4.php
http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/ip.htm

>>> What could be causing this sequential use of local ports?
>>
>> Normal behaivior of an avarage TCP/IP stack.
>
> I am going to get a hardare firewall when I can afford to.

Your stack won't behave any diffrent with a hardware firewall. What you
observe is totally normal behaivior and absolutely nothing to worry about.

Wolfgang

Similar ThreadsPosted
Firewall shows ports being used in sqeuence December 5, 2005, 9:28 am
Re: Firewall shows ports being used in sqeuence December 5, 2005, 9:57 am
IE shows ".url" extension!. January 17, 2006, 1:32 pm
Sniffer for Windows That Shows Process ID? October 10, 2007, 3:26 am
Configure DCOM client to use only a small range of ports (instead of random ports) August 16, 2006, 4:43 am
Router log shows port 1026 activity? May 8, 2006, 12:46 pm
HeadphoneTV.com - Best in StreamingTV! 27000+ episodes of your favorite shows without Downloading! December 2, 2006, 11:49 pm
how to enable the vpn ports in the pix firewall September 13, 2005, 6:18 am
Re: firewall - ports - never attached !!! July 19, 2007, 12:53 pm
Configuring F-Secure Firewall Ports December 23, 2004, 7:11 am

The site map in XML format XML site map

Contact Us | Privacy Policy