I would like to be able to PAT such that outbound traffic for a given destination port is translated to some random port within a range on a per-PDU or per-packet basis.

The intention is that outbound traffic will be 'scattered' across the specified port range, similar to the principle of frequency hopping for radio transmission... Preferably, I would like this to be transparent to upstream applications.

An example scenario would be a file transfer utility that sends a stream of packetised data to host with destination port 9080. I would like to translate (perhaps even listen on localhost TCP port 9080) all traffic for a given host with destination port 9080 such that each packet goes out to the given host on a random port between, say 49000 to 50000.

To further clarify, I am not concerned with the source port from which traffic originates. My intention is to have a sender that sends on destination port 'N' across a link to a receiver that is listening for traffic coming in on destination port 'N'. After traffic leaves the sender, I want to randomize the destination port to a value within a known range... so a bunch of traffic will be seen over the wire with random destination ports... because the range is known, this traffic can then be re-translated to destination port 'N' by the firewall or similar at the receiver end.

Similar to:

[N]         = packet with destination port 'N'

[A <=N=> B] = packet with destination port between A and B

                                     /--[49000 <=N=> 50000]--\
SENDER --[N]-[N]-[N]--> (RANDOMISER)<---[49000 <=N=> 50000]--->(UNDO)-[N]-[N]-[N]-->RECEIVER
                                     \--[49000 <=N=> 50000]--/

I am looking to achieve this on both Windows and Linux platforms. So far I am unable to find much in the way of useful information or suggestions, and so any advice or suggestions would be appreciated.

  • am I understanding you, that you want every segment in a TCP connection to appear to come from a different port? – Frank Thomas Apr 9 '15 at 14:01
  • Thanks again for replying. In fact, I want the opposite - I want every tcp segment to be destined for a different port. I can handle redirection / retranslation at the receive side... – J Ivory Apr 9 '15 at 14:57
  • Well, you would need a custom PAT implementation to do it in a way that doesn't break TCP logical circuit connections. TCP by default defines a connection as a coordinated flow of segments between a pair of ports, with negotiated SNY/ACK values, so it can reorder as needed, notice missing segments to signal for a resend, and particularly in the case of NAT/PAT, that each end can tell that the segment is part of an established connection in accordance with Stateful Packet rules. A standard PAT implementation would treat each segment as unsolicited, and not part of an established connection. – Frank Thomas Apr 9 '15 at 16:16

Windows assigns outgoing client connections to the first available TCP port > 1024 by default, unless the application specifies a port for connection.

you can change the starting port for this behavior, using the netsh commands shown here: http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/Admin/DefaultDynamicPortRange.html so you can set it to start at 40000 and the end at 50000if you like.

In linux, you can change the starting/ending port behaviour using sysctl: http://www.lognormal.com/blog/2012/09/27/linux-tcpip-tuning/

That said, you will not be able to select ports randomly, using these techniqies. I would be surprised if you could alter that functionality without changing OS source code, and many application would not play nicely with the functionality.

hope that helps.

| improve this answer | |
  • Hi Frank - many thanks for responding. If I have understood correctly, you are describing the allocation of an arbitrary local source port from which the communication originates, rather than the destination port which traffic is sent to? I believe I may need to clarify my question, and so will edit this accordingly. – J Ivory Apr 9 '15 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.