Ephemeral ports

[Mark Perschbacher_1]

I have been trying to determine why an HP rp5470 server running HP UNIX 11.0 would use ephemeral ports when setting up a TCP socket connection with a Win2003 server, and not with a Win2000 server. Both of the Win servers are on a separate network from the rp5470, and acting as clients. The firewall the rp5470 sits behind is blocking the messages to the w2003 server as a result.

[Jeff Schussele]

Define ephemeral?
I'm confused - but when Wintel's in play, I'm not surprised.
Are you talking about "high" ports?
Well....that's a negotiation - takes 2 to tangle....
Think MS is at fault first....
And if a FW is in there, well again - check it's rules.

My 2 cents,
Jeff

[Mark Perschbacher_1]

What we are seeing is that the rp5470 typically has three entries in netstat -n for the Win2003 server. One in the SYN ACK state, one is WAITING, and another in ESTABLISHED, for example. Each entry has a local port number incrementing up. For the Win2000 server, there is just a single entry in netstat -n in the ESTABLISHED state. I know nothing about HP UNIX, and am just trying to figure out why the rp5470 would be reacting differently.

[Jeff Schussele]

Hi (again) Mark,

All you need to focus on is "Established".
Anything else is a failed connection or a "broken" one.
FIN-WAIT2 is a classice example of net problems or some knucklrhead that "X"'d out of session instead of properly exiting.
Remember that Wintel folks don't care about "rules".
Hit & runners, I call 'em.

Rgds,
Jeff

[Mark Perschbacher_1]

I have spent alot of time researching the build and tear down process for TCP sockets, so I have a good understanding of what it going on, its the why part I am trying to determine. The vendor claims that the settings are identical for the interface that does not change ports. Using the nettune command, could the server be forced to only use a single, or small range of local ports?

[James R. Ferguson]

Hi Mark:

You can use 'ndd' to change the ephemeral range by tuning 'tcp_smallest_anon_port' and 'tcp_largest_anon_port. By default, this range is 49152-65535.

See the manpages for 'ndd'.

For example:

# ndd -set /dev/tcp tcp_smallest_anon_port 50000

# ndd -set /dev/tcp tcp_largest_anon_port 55000

Regards!

...JRF...

[Ralph Grothe]

I think for the tcp/ip stack on 11i you can at least set the upper bound for anonymous ports.

Don't know if this is of any help to your problem?


# ndd -h tcp_largest_anon_port

tcp_largest_anon_port:

Largest anonymous port number to use. [1024, 65535]
Default: 65535

[Ralph Grothe]

Hm, your milage may vary.
But on my 11i system the smallest anon ports are listed as unsupported params.

# ndd -h unsupported|grep smallest
tcp_smallest_anon_port - Smallest anonymous port number to use
tcp_smallest_nonpriv_port - Smallest port number non-privileged processes
udp_smallest_anon_port - Smallest anonymous port number to use
udp_smallest_nonpriv_port - Smallest port number non-privileged processes

[James R. Ferguson]

Hi (again) Mark:

The Knowledge Base (#UTRANKBRC00009720) notes that tuning the anonymous port range is permitted but must be done before any networking services are started (obviously!). This means before '/sbin/rc2.d/S100swagentd' is started.

If this is your intention, have a look at the aforementioned document for more details.

Regards!

...JRF...

[Mark Perschbacher_1]

I will turn all this useful information over to the vendor that supports the rp5470, thanks a lot for all your input. I have just started posting questions on these forums, and have had really good responses.

[rick jones]

For an application to use a port that is not in the ephemeral (anonymous) port range, it must make an explicit bind() call to bind to that port number. One can use tusc to trace the system calls being made by said application and see those bind() calls.