mailing list archives
RE: Private port numbers?
From: "Lars Higham" <lhigham () yahoo com>
Date: Thu, 14 Aug 2003 11:22:23 +0530
It's a good idea, granted, but isn't this covered by IPv6 administrative
From: owner-nanog () merit edu [mailto:owner-nanog () merit edu] On Behalf Of
David G. Andersen
Sent: Thursday, August 14, 2003 8:33 AM
To: Christopher L. Morrow
Cc: Crist Clark; nanog () merit edu
Subject: Re: Private port numbers?
On Wed, Aug 13, 2003 at 10:40:30PM +0000, Christopher L. Morrow quacked:
what about ports that start as 'private' and are eventually
ubiquitously used on a public network? (Sean Donelan noted that
137->139 were originally intended to be used in private networks...
and they became 'public' over time)
You run it on a different port. I actually really like this idea,
because it makes shipping a more secure default configuration easier for
vendors without having to coordinate between firewall vendors and
The "gotcha" is that it makes life pretty weird for you if you then want
to make your service work in the wide-area... but that's pretty easy to
do with intelligent defaults:
Ports 1-1024: Well-known-ports
Ports 60001-61024: Private well-known-port analogues
Applications would try:
if (!connect(..., public port #))
connect(..., private port #))
In fact, this (impractically) generalizes to a nice way of signifying
whether or not you want external people to be able to talk to your
port bit == 0: Public service, please do not filter
port bit == 1: Private service, please filter at
I suddenly wish the port space was 32 bits. :)
People _could_, of course, implement all of this with tcpwrappers and
host-local firewalls. But experience has shown that they don't. It
might be easier for them if they could just click "private" when they
configured the service, though experience has shown that services
migrate to the less restrictive mode as debugging and time goes on...
work: dga () lcs mit edu me: dga () pobox com
MIT Laboratory for Computer Science
I do not accept unsolicited commercial email. Do not spam me.
Re: Private port numbers? Stephen J. Wilcox (Aug 14)