Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

processes and ports

Options
  • 24-02-2004 1:29pm
    #1
    byrnenj
    Closed Accounts Posts: 566 ✭✭✭


    Hi,

    I'm trying to understand the working of packets and all that a little better and i'm, a little confuces about one thing, so i thought i'd ask.

    I'm tracing a packet from my machine to a webserver and back. The packet goes out and established a connection on port 80 with the web server. Now Internet Explorer on my machine will have sed a random packet number in it's initial SYN request to the web server for it to communicate back on. This is where i'm unsure of what happens.

    The web server is taking back to my machine on port 2148, for example. Is my machine talking back to the web server still through port 80 or has it assigned me a random port for my connection.

    I've been running lots of netstat's on my machine trying to find out whats going on, but without seeing things from the servers side i can't figure it out.

    So basicly :

    I send a packet to webserver on port 80 requesting it to reply on port 2148.
    Webserver replies to me on port 2148
    I reply to web server on XXXX port?
    Is it port 80 or another randomly assigned port for this particular session.

    Hope i'm clear about what i'm asking here...or have i just really confused everybody reading this?

    Thanks for your help


Comments

  • Options
    #2
    fatherdougalmag
    Registered Users Posts: 1,391 ✭✭✭fatherdougalmag


    You could always run a minimal web server on your machine and use 127.0.0.1 as your destination IP. That way you can see everything. Use something like MiniShare which requires minimal (i.e. no) configuration.


  • Options
    #3
    Tenshot
    Registered Users Posts: 648 ✭✭✭Tenshot


    When you use TCP to connect to a remote site, the port number you connect to (80 in this case) is the port number that gets used for the duration of the connection. Similarly with the port number you connect from.

    TCP doesn't rely purely on port numbers to keep track of all the connections: it actually uses a combination of (source IP address, source port, destination IP address, destination port). Every TCP/IP packet includes all four pieces of information in the header, making it possible for the receiver to figure out which connection it belongs to.

    So, there is no problem with having lots of different clients all connecting to the same port 80 on a web server. There is also no problem having several connections from the same client to port 80 on a particular remote webserver, as long as the local port number is different each time. And it is - as you've noticed, the local port number usually increases by one every time a new connection is established.

    Have you got a copy of Ethereal? If not, download it from http://www.ethereal.com/ - it will let you see exactly what packets are being sent to and from the web server, what ports are being used, etc. Very useful (especially its "Follow TCP stream" option, which shows only those packets belonged to a particular TCP connection).


Advertisement