Hack Security Pro.pdf - Index of

TCP/UDP Port Notions: Multiplexing/Demultiplexing
A station can simultaneously transmit and receive several TCP and UDP data flows. For this to happen,
each extremity (and these can be different for each established communication) must be attached to a
packet arriving on an interface. To do this, TCP and UDP protocols use port numbers. These numbers
are COMPULSARY in any TCP or UDP communication, and can associate a communication to a
process. All data transiting on the network therefore has two port numbers: the first one on the
transmitting side, the second one one the destination side. All communications thus have 2 couples of
numbers (IP address, port used) relative to an extremity.
TCP and UDP ports are totally independent. It is therefore possible to have a simultaneous
communication on port 25/TCP and port 25/UDP.
This technique corresponds to multiplexing/demultiplexing. By decoding the port number in the packet,
data is sent to one or the other process of the system. Systems conventionally implement the following
rules:
• Port numbers under 1024 can only be used by the super-user,
• A client application using TCP or UDP will use a port number above 1024 (even if the user is
the super-user). There are however some voluntary exceptions, such as r-services...
A communication implies that a port be open to the client machine and that another port be open to the
server machine. These ports are not necessarily the same one.
1. A server application opens a port permanently to allow for waiting time for connection requests.
2. A client application opens ports on a needs basis. It does not wait for a connection request, it
does not have the role of a server application and therefore it is not a point of entry into a system.
3. There are 65,535 ports; no more, no less. Most of these are reserved for specific services (FTP:
21, telnet: 23, SMTP: 25, etc.)
4. A closed port is like a wall made of reinforced concrete: nothing enters, nothing exits.
Examples
1. When A sends to B a TCP packet with an activated SYN flag, and the requested port is closed, B
machine sends back a TCP packet with an activated RST flag. Some firewalls do not send back
a TCP packet with an activated RST flag (such as ZoneAlarm).
2. When A wants to connect to B's HTTP server, its client application (Internet Explorer) will open a
port (1106, for example). The client application will send a packet made up of IP, TCP, HTTP
headers to port 80 of B machine.
The Hackademy DMP -17/209- SYSDREAM