6

In general ephemeral ports are used by clients when establishing connection with the server.

For example:

  1. Server listens on port 80
  2. A client (browser, FTP client, bittorent client) send a request to server including ephemeral port assigned by OS
  3. Server responds using provided ephemeral port as destination port

And now the question:

I wrote a server application which I would like to start on random free port each time it is started (To keep this question consist I will not explain why I would like this behaviour). Now my question is what implications would it have if I use one of ephemeral ports for server to listen on. Are there any drawbacks (also in terms of security) of doing this?

Do you maybe know any example of a server that is also make use of ephemeral ports in practise?

One of my concerns is also statement from The TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference (page 705):

Just as well-known and registered port numbers are used for server processes, ephemeral port numbers are for client processes only.

3
  • So... kind of like bitorrent?
    – Journeyman Geek
    May 9, 2014 at 6:47
  • 1
    Actually FTP did it first. It had the server connect back to the client on the port the client gave for data transfer. This didn't work with proxies and NATs so a passive mode was implemented that used the same connection that the client first used to transfer data.
    – Dan D.
    May 9, 2014 at 7:07
  • Actually (if I understand right) bittorrent's and FTP's clients are listening on ephemeral port but I would like for server to listen on ephemeral port provided by OS as long as server is up. So my questions is whether it is safe to do this as ephemeral ports are generally used by clients for short-lived transport protocols.
    – PrimosK
    May 9, 2014 at 7:46

2 Answers 2

3

If you listen on an ephemeral port you may run the risk of TCP self connect.

2

As a help the Wikipedia page on Ephemeral Port gives more information about the port numbers actually used by OS.

From this one can immediately see there are many ports available that are not typically used by server (processes) and are not in the ephemeral range.

Thus the obvious solution would be to randomly select from one of those other ports. This avoids needing to make assumptions about how the OS allocates from the ephemeral range: does it check actual use or just its allocations to avoid collisions for new allocations?.

That question might seem minor, but with a client port the process does not usually directly use the port number (it is allocated when the process opens the connection, only by looking at the socket's properties can the process find the number: and usually this is completely unnecessary). However to accept incoming connections the socket must be bound to a specific port, thus the server process is responsible for getting a port number.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .