UDP Sessions and Ephemeral Port Selection

portsessionudp

I would like to ask community to help me finding answers to the following questions:

According to RFC 6056 an operating system should pseudo-randomly select ephemeral ports for each transport layer connection. For TCP, which is stateful protocol, the situation is clear: the ephemeral port is assigned to 5 tuple {protocol, source_ip, source_port, destination_ip, destination_port} until the connection is dropped. However, UDP is a stateless protocol, there is no UDP connection. Therefore, for me it is not clear how an ephemeral port is assigned in case of UDP. Is it different for every request? Is it randomly assigned to 5 tuple and preserved until no packets received during a TIMEOUT?
Are the differences in the implementations of various operating systems, e.g., Windows, Unix, Linux?

Best Answer

According to https://www.cymru.com/jtk/misc/ephemeralports.html the selection strategy varies between random and sequential depending on OS. Based on my observations, it the source port for UDP is different for each request.

Related Solutions

Listen to UDP data on local port with netcat

To quote the nc man page:

-l Used to specify that nc should listen for an incoming connection rather than initiate a connection to a remote host. It is an error to use this option in conjunction with the -p, -s, or -z options. Additionally, any timeouts specified with the -w option are ignored.

The key here is that -p cannot be combined with the -l flag. When using the -l flag, any ports specified in the positional arguments are used. So instead, you could use the following:

netcat -ul 2115

Linux – Check if port is open or closed on a Linux server

You can check if a process listens on a TCP or UDP port with netstat -tuplen.

To check whether some ports are accessible from the outside (this is probably what you want) you can use a port scanner like Nmap from another system. Running Nmap on the same host you want to check is quite useless for your purpose.

Related Topic