Wanted to know the meaning of source and destination port. (wireshark) - wireshark

On my package 1, under the info it says (source)54841 > 80(destination). May I know what are these terms mean and why these particular ports are being used. i know that for tcp, they uses 80 for destination port. but is there a particular reason? Thank you

In fact, there are two questions with two different answers.
Firstly, you have to be exact: The port definition is part of the Internet Proctocol (commonly called TCP/IP) application layer. The tcp protocol is a protocol of the underlying transport layer, so the definition / use of port 80 is not defined for tcp, but rather for the http application protocol (while the actual port usage takes place in the transport layer).
Regarding the destination port, you nearly gave the answer yourself: For well defined application protocols, there were defined well known ports. The list is maintained by IANA (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml). Usually, the ports were defined in the privileged low number range (up to 1024). When that range became to full, there were also higher port numbers assigned.
The reasoning behind the well defined port numbers is, that services can only listen on specific ports, and if the numbers were known by convention, you had to memorize them along with the server adress. For your example, HTTP, that means, that if you start a request for http://www.example.com, your browser (or other software) knows that http usually uses port 80, connects to that port to get the html page. You can still run http servers on different ports (say, 12345), but than, the user had to enter http://www.example.com:12345 to reach the server. You can see that using well defined ports is helpful here.
For the source port, it is a completely different story. As transport layer connections usually use ports for multiplexing/demultiplexing on both source and destination, every connection must also have a source port. The lower port numbers can not be used for this purpose, as on one hand, they are often used for listening services, and on the other hand, their usage is privileged on some operating systems, so normal users cannot use them at all. For this reasons, IANA assigned the port range from 49152 to 65535 (2^15+2^14 to 2^(16−1)) for that purpose. Most operating systems will select one of this ports for outgoing connections source port. The selection is, however, short lived - when the connection is closed, the port is released, and the next connection can use an other port.

Related

Writing To Multiple TCP Ports From A Print Monitor

I have a language monitor that I am trying to query the printer from.
First let me apologize for the possible confusion since "port" means 2 things in this description. There is the one use that refers to the port that the printer is configured to use, which could be TCP, USB, etc. And then there is the use of port that refers to the port address to send data to when communicating with the printer's IP address.
I need to be able to specify different port addresses to send different custom queries to a printer over the same IP that are specific to it's firmware. I can't find any examples or documentation on what the standard way is to do this communication... I can extract the IP address and open a net socket, but I am not sure if this is the appropriate way to handle this communication. It's not uncommon for printers to send status over one port, and print data over another. If i want to write to the Default port I can use pfnWritePort and pfnReadPort, but these don't allow me to specify the actual port.. it uses whatever the driver is configured as.
Can anyone provide some guidance or examples of how I should do this from my language monitor?
EDIT: As an example for clarification, all commands are sent to the same IP, but depending on the command/query I need to send, the TCP port needs to change. The way I am handling it now is opening up a net socket with the same IP and different port numbers for data and status channels).
You should be required to write an app that would be able to reconfigure driver. Ideology of OS is that EACH real device would corresponds to instance of driver and\or interface. Which might be an elevated action, because it requires to create new printer interface("port" in Windows GUI terms) and change driver settings.

local host, port number, and TCP/IP & UDP

I am trying to program a script to interface two applications, so I need to understand a few basic concepts, if someone could please help me grasp them:
When an application's manual says: This app listens to localhost:9763, it means it receives live data from the same machine on port number 9763. Is this correct?
So, if an application's manual says: Listen on UDP port 6004, it means I have to specify localhost:6004 similar to the first point?
Or does the first point (localhost:9763) imply that TCP/IP is being used, but the second point is on UDP?
Generally speaking, if an app says it is listening on a particular port and doesn't specify TCP or UDP, that usually means TCP. If you're not sure, you can probably figure it out based on what that particular app does and how it does it.

What is the significance of port number in localhost?

Different websites uses different ports, like Codecademy uses localhost:8000 in its AngularJS and Ruby On Rails tutorials. So, I want to know what is the use of this 8000 in localhost:8000. Thanks in advance :-)
This is not specific to one framework, it's a much lower level. From Wikipedia:
In computer networking, a port is a software construct serving as a communications endpoint in a computer's host operating system. A port is always associated with an IP address of a host and the protocol type of the communication. It completes the destination or origination address of a communications session. A port is identified for each address and protocol by a 16-bit number, commonly known as the port number.
Specific, well-known port numbers are often used to identify specific applications and services. Of the thousands of enumerated ports, 1024 well-known port numbers are reserved by convention to identify specific service types on a host. The protocols that primarily use ports are the Transport Layer protocols, such as the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) of the Internet Protocol Suite.
In the client-server model of application architecture, ports are used to provide a multiplexing service on each port number that network clients connect to for service initiation, after which communication is reestablished on another connection-specific port number.
I assume, there's a task runner like grunt or gulp serving the page via BrowserSync (or similar). They use a different port than 80 to not interfere with an already occupied port by a local web server (apache, nginx,...).
This is just a port which rails is listening to. It depends on how you configure your rails server, and, IMHO does not mean anything useful. Sometimes you have to assign service to a different port because default port is occupied by some other service. Sometimes it is done by security reasons, so the hacker from outside world has to know the port you are using. But it's actually not very hard to know
Just to add to what the others have said: all network communications require an ip address (which can be got from a domain name like www.google.com) and a port number. However, if a port number is not supplied then the http server uses the default: this is usually port 80. So, if you were to go to "localhost" without a port, you are effectively saying "localhost:80". Your computer probably doesn't know what to do with this. If you say "localhost:8000", and there's a rails server there, then it will handle the request.

send non-flow message from controller to OpenFlow switch

I'm using a real machine (hp procurve) for my project, I need to send message of other protocol format, OSPF for instance, instead of flows, from controller side to OpenFlow switch through socket(by specifying ip address and port of the OF switch).
But everytime I try to do this, I get "Connection refused" error message, I guess that it might be that the port on OpenFlow switch I'm sending the message to is not listening, so I think I might need to use the same port for the sending which OpenFlow switch uses to talk to the controller, like the port 51067 in the log info :
Switch:192.168.1.11:51067 is connected to the Controller
My question is, how do I retrieve the port information on the controller side, since it is changing every time I restart it? I couldn't find this information.
Or am I going the wrong direction that I need to go another way around instead of sending the message using socket?
Thanks a lot in advance, any suggestions will be appreciated.
jonesir
I think you are misunderstanding the nature of networking ports, protocol numbers, and protocols such as OSPF. Let me clear those up:
Port numbers: Usually, there is exactly one application listening on a single port: The operating system/networking stack checks each packet of certain types (e.g. TCP or UDP) for the port number and then passes the packet to the application that registered itself for that specific port. If the application cannot handle the received packet then usually it will just ignore it or log an error.
Aside: It is possible for two applications to communicate on the same port only if you put some sort of multiplexing application before both (usually a reverse proxy, possibly a TCPMUX application). This multiplexing application would take incoming packets, determine what type of packet it is and then pass it to the correct application.
Protocol numbers: The protocol number is a field inside an IP packet that tells the networking stack what type of data is contained inside. For example, TCP is protocol 6, ICMP is 1, and OSPF is 89.
OF switches: Now, logically an OF switch consists of two components: 1) the switching fabric (which includes the physical ports and OF flow tables), and 2) a separate physical port to for out-of-band control, with several applications running behind it. One of these applications is the OpenFlow application, which in your case happens to listen on port 51067. But in real switches, other applications might also be running on different ports, e.g. a web interface running on port 80 for maintenance etc.
OSPF: If you now wanted to talk to the application serving the web interface, you'd send a TCP packet with destination port 80 from your controller to the switch. Similarly, if you'd like to install a new flow, you'd send an TCP packet with port 51067 in your case. OSPF is quite different, as it directly uses IP packets and does not use port numbers. To process an OSPF packet, an application needs to use a raw socket to process the incoming IP packets that have protocol number 89, and skip all others. See also the raw manpage here. This will already be built into your OF switch.
Thus, if you want to send an OSPF packet to the OF switch (and your OF switch supports OSPF on the separate physical port!), you'd just send an OSPF IP packet to the switch's IP address (192.168.1.11), no port needed!
Note that the separate physical port might not support all of the features of the other ports on the OF switch, as they are not intended for the same uses.

Should I register my multiplayer game's port with the IANA?

I have a piece of multiplayer game software which is approaching maturity and will hopefully be in a public testing phase soon. For informal private tests, I've been using a port number that I'm fond of, which falls in the User Port range, 1024-49151. I'm wondering if it will behoove me to register a port with the IANA (in this case, I can't use my current port because it's already used by a very obscure service).
I'm a bit puzzled at the fact that we are told not to utilize User Ports without registering them, and yet most major multiplayer games (e.g. Call of Duty, Team Fortress 2, Minecraft) use numbers in this range with no registration. Are games not considered to be a "significant" use of this range, warranting registration? Should I avoid this issue altogether and pick a number from the Dynamic (Ephemeral) range, 49152-65535? I just wonder why most games avoid this upper range if it obviates the need for IANA registration (fear of collision with a temporary port?). Or needn't I worry about registration at all? I'm just trying to be a responsible netizen as I prepare to release my first networking application. Thanks.
If a specific port must be opened on each individual client *, you need to register a port in the User Ports range, because of of RFC 6335, 8.1.2.:
[...] application software MUST NOT assume that a specific port number in the Dynamic Ports range will always be available for communication at all times [...]
On your server (if any) you can use any port, without registration. However I'd recommend using a port in the Dynamic Ports range there as well. Your clients could then fetch a list of servers and their current port numbers from some kind of master server (for example via HTTP / Port 80 or HTTPS / Port 443). That way you 1. eliminated mis-used User Ports and 2. can change your actual server ports at any time.
*: If your players are behind a NAT, client-side ports have to be forwarded in the NAT settings; that will make your game hard to play for inexperienced users. It is probably a better idea to redirect all traffic through your server(s)...
If you use a server somewhere and you really need a client-side protocol you can circumvent the issue of registering with the IANA by opening a random dynamic port instead and notifying the server of that port, which then notifies all clients wanting to connect. That way, you don't need any user port at all, and thus no registration. But this makes it even harder for users behind a NAT.

Resources