WSM Reference Guide - WatchGuard Technologies

Standard Ports and Random PortsTCPTransmission Control Protocol (TCP) enables two hosts to make a connection and send streams of datato each other. TCP makes sure that the data that is sent gets to its destination. It also makes sure thatpackets are put in the same sequence as when they were sent.TCP manages connections with properties that control the condition of a connection. Three very importantproperties of TCP packets are the SYN, ACK, and FIN bits. The SYN bit is set only on the first packetsent in each direction for a given connection. The ACK bit is set when the other side gets the data. TheFIN bit is set when the source or destination closes the connection.ICMPThe Internet Control Message Protocol (ICMP) is most frequently used to supply error information aboutother services. It operates using the same method as UDP. That is, it does not use connections and doesnot make sure that packets get to their destination. One dangerous ICMP packet is the ICMP redirectpacket, which can change routing information on the devices that receive it.Other protocolsMost traffic on the Internet uses TCP, UDP, or ICMP protocols. Some other protocols are as follows:IGMP (Internet Group Multicast Protocol)A protocol used for hosts on multicast access networks to tell locally attached routers the groupthey are a member of.IPIP (IP-within-IP)An encapsulation protocol used to assemble virtual networks on the Internet.GGP (Gateway-Gateway ProtocolA routing protocol used between different systems.GRESA protocol used for PPTP.An encryption protocol used for IPSec.Standard Ports and Random PortsUDP and TCP use encapsulation of information contained in the application layer. The software applicationprocedures are specified by source ad destination port numbers. These port numbers, togetherwith the source and destination IP addresses, supply a unique connection on the Internet.For example, you can have two telnet sessions from one host to a different host. Since telnet uses a wellknownservice port number of 23, something must be different between these two connections. Theother port in these conditions is a port that is usually larger than 1023. The operating system on the clientside assigns this port number automatically.Random ports can cause problems if they match a well-known service on a port higher than 1023. Ifsome client computer assigns a random port of 2049, no connection can be made. This type of problemfrequently occurs with the X Window and Archie services.Usually, most operating systems assign port numbers between 1024 and 2100. Because of this, thisproblem does not occur frequently.6 WatchGuard System Manager