OpenVMS and port 65535

[Kirk Reindl]

2 node OVMS cluster
ver 7.3-1
TCPIP ver 5.something

Hello all,
I'm unsure of the best way to phase my question, so I'll just explain my situation and hope I'll get some responses.

A co-worker has a laptop running XP and also runs Norton anti-virus/FW.

He has showed me the Norton log at it shows "attacks" from both nodes in this VMS cluster. It shows that it is "going after" port 65535.

Now I've done some investigating and found out that ports 49152-65535 are dynamic, not really governed, and Services typically use one or more random free ports in this range when they need to perform multithreaded socket communcations.

Now, I do not know much about what the apps do on this cluster at this moment.

Could any one give me a clue as to what might be causing my VMS cluster to be scanning 65535 on this co-workers laptop?

Thanks

[Martin P.J. Zinser · Accepted solution]

Hi Kirk,

if you can get the colleague to get in touch
with you while this happens a $ tcpip netstat -a might shed some light on this. What is looking strange is that 65535 is the maximum allowed port number of the dynamic range.

Greetings, Martin

[Willem Grooters]

First: What type of network: IP4 or IP6
On IP4, 65535 - AKA 64K, the highest unsigned 16-bit number - is the highest possible port. If Norton FW shows 'attacks' above this boundary I would just ignore it.

I'm not sure on IP6. XP is IP6-ready, and if you're running latest TCPIP on VMS, that one will be as well. If IP6 has a higher number of ports, that would explain the 'attacks' above port 65535.

Has the cluster routing enabled (routed of gated), it may be that this protocol scans the adjacent nodes to exchange information using port 65535 - and higher if on IP6 (and possible there). Not unlikely that your co-worker's laptop has the very same behavour to the cluster....

The only way to find out what applications or services uses this port (if any) you need to investigate both the cluster and the PC.

Willem

[faris_3]

Hi,

At the time of the problem,
take a
TCPIP SHOW DEVICE on the cluster nodes
and a tcptrace or tcpdump trace
between the nodes and the XP.

hth,
HF