UDP/TCP Ports 1

[NFI]

Hello,

can somebody explain to me how exactly ports work, please? I was under the impression, until recently, that ports were a bidirectional affair, used mainly to identify/direct network traffic to the appropriate layer 7 application. Now, I find, that this is only really true at the server (or service providing) end. Indeed, a client computer, for example, doesn't need to have port 80 open to browse the internet, as HTTP traffic enters port 80 only at the webserver and appears to come back to the client at some, pseudo-random (I assume), port higher than 1024. How does the client deal with this? How do firewalls cope with it? In fact how do gateways and pretty much all network components cope with this?

Any explanations will be greatly appreciated,

Thanks,

Paul

 

[LawnBoy]

Client sends a request from port xxx to port 80 on the webserver. Webserver recieves request on port 80 and replies to the origination port (xxx).

Firewall sees client send to webserver, allows webserver to continue the conversation. Firewall tracks all connections.

Proxy intercepts client request, changes origination port to whatever it deems appropriate. Proxy then sends request for the client, recieves answer from webserver, changes port back to client origination port, and sends webserver response to client.

Sorry for being so terse, very busy today!

 

[NFI]

No, terse is good

I take it xxx is pseudo-random 1024+?

So, the sequence of events is something like this?

1. Browser determines pseudo-random return port number
2. Browser send HTTP request to source port 80
3. Client Firewall remembers return port number
3. Server responds to pseudo-random port number
4. Client Firewall forwards HTTP traffic to browser

Is that about it?

Does this mean the firewall is sort of session (or at least transport layer) aware?

Thanks for your help,

Paul

 

[LawnBoy]

Well the devil is in the details but pretty much that's what's happening. Some might argue with the exact wording of either of our descriptions but I think them a valid "block diagram".

Yes a firewall does session tracking. Otherwise it wouldn't know how to allow a response from external while blocking any new connection attempts from external.

Glad I could help.