Ephemeral port selection

[Fernando Gont]

Folks,

Looking at FreeBSD's TCP implementation, I see that by default, 
ephemeral ports are selected from the range 49152-65535. This means 
that only 15K ports out of the available 65K port range are used for 
ephemeral port selection.

This has at least two implications:
* Ephemeral ports are easier to predict (as you are picking them from 
a smaller range)
* There is a higher chance of facing the interoperability problems 
described in Mike Silbersack's presentation at EuroBSDCon 2005 
(http://www.silby.com/eurobsdcon05/eurobsdcon_silbersack.pdf).

A first and small proposal would be to change the range of ephemeral 
port numbers to use the range 1024-65535. An array of bits could be 
maintained in memory to avoid the selection of ports that are used 
for services (e.g., X).

We have also been working on an alternative port randomization 
scheme, that would help to avoid the problems described in Mike's 
presentation. Our work on the subject is available at: 
http://www.gont.com.ar/drafts/port-randomization/draft-larsen-tsvwg-port-randomization-01.txt

We would be willing to provide patches for these things if there is 
interest in implementing the proposed changes (extending the port 
range and possibly implementing the RFC1948-like scheme for ephemeral 
port selection).

Any comments will be more than welcome.

Thanks,

-- 
Fernando Gont
e-mail: fernando at gont.com.ar || fgont at acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1