Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #187432 > unrolled thread

Free TCP/IP port numbers?

Back to article view | Back to linux.debian.user

Contents

  Free TCP/IP port numbers? Victor Porton <porton@narod.ru> - 2017-10-01 03:20 +0200
    Re: Free TCP/IP port numbers? "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-10-01 03:30 +0200
      Re: Free TCP/IP port numbers? Victor Porton <porton@narod.ru> - 2017-10-01 04:00 +0200
        Re: Free TCP/IP port numbers? "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-10-01 04:30 +0200
          Re: Free TCP/IP port numbers? Gene Heskett <gheskett@shentel.net> - 2017-10-01 07:30 +0200
            Re: Free TCP/IP port numbers? <tomas@tuxteam.de> - 2017-10-01 09:40 +0200
              Re: Free TCP/IP port numbers? tomas@tuxteam.de - 2017-10-01 09:50 +0200
              Re: Free TCP/IP port numbers? Gene Heskett <gheskett@shentel.net> - 2017-10-01 13:50 +0200
                Re: Free TCP/IP port numbers? Reco <recoverym4n@gmail.com> - 2017-10-01 14:20 +0200
                  Re: Free TCP/IP port numbers? <tomas@tuxteam.de> - 2017-10-01 15:00 +0200
                  Re: Free TCP/IP port numbers? Gene Heskett <gheskett@shentel.net> - 2017-10-01 15:50 +0200
                    Re: Free TCP/IP port numbers? <tomas@tuxteam.de> - 2017-10-01 16:20 +0200
                      Re: Free TCP/IP port numbers? Reco <recoverym4n@gmail.com> - 2017-10-01 16:50 +0200
                        Re: Free TCP/IP port numbers? rhkramer@gmail.com - 2017-10-02 23:10 +0200
                        Re: Free TCP/IP port numbers? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-10-02 23:10 +0200
                          Re: Free TCP/IP port numbers? Reco <recoverym4n@gmail.com> - 2017-10-02 23:30 +0200
                      Re: Free TCP/IP port numbers? Gene Heskett <gheskett@shentel.net> - 2017-10-01 16:50 +0200
                        Re: Free TCP/IP port numbers? <tomas@tuxteam.de> - 2017-10-01 17:00 +0200
                          Re: Free TCP/IP port numbers? Gene Heskett <gheskett@shentel.net> - 2017-10-01 17:40 +0200
                            Grep's "ignore binry files" option [was: Free TCP/IP port numbers?] <tomas@tuxteam.de> - 2017-10-01 18:00 +0200
                              Re: Grep's "ignore binry files" option [was: Free TCP/IP port numbers?] Gene Heskett <gheskett@shentel.net> - 2017-10-01 18:40 +0200
                Re: Free TCP/IP port numbers? <tomas@tuxteam.de> - 2017-10-01 14:50 +0200
                Re: Free TCP/IP port numbers? Dan Purgert <dan@djph.net> - 2017-10-02 12:30 +0200
        Re: Free TCP/IP port numbers? shawn wilson <ag4ve.us@gmail.com> - 2017-10-01 04:40 +0200
          Re: Free TCP/IP port numbers? Dan Purgert <dan@djph.net> - 2017-10-02 12:30 +0200
            Re: Free TCP/IP port numbers? Michael Stone <mstone@debian.org> - 2017-10-02 12:50 +0200
    Re: Free TCP/IP port numbers? deloptes <deloptes@gmail.com> - 2017-10-01 10:00 +0200
    Re: Free TCP/IP port numbers? <tomas@tuxteam.de> - 2017-10-01 15:00 +0200
    Re: Free TCP/IP port numbers? Victor Porton <porton@narod.ru> - 2017-10-01 15:00 +0200
      Re: Free TCP/IP port numbers? Michael Stone <mstone@debian.org> - 2017-10-01 15:20 +0200
      Re: Free TCP/IP port numbers? Nicholas Geovanis <nickgeovanis@gmail.com> - 2017-10-04 16:50 +0200
    Re: Free TCP/IP port numbers? Gene Heskett <gheskett@shentel.net> - 2017-10-02 23:00 +0200
      Re: Free TCP/IP port numbers? Reco <recoverym4n@gmail.com> - 2017-10-02 23:30 +0200

Page 2 of 2 — ← Prev page 1 [2]

#187461 — Re: Grep's "ignore binry files" option [was: Free TCP/IP port numbers?]

On Sunday 01 October 2017 11:56:01 tomas@tuxteam.de wrote:

> On Sun, Oct 01, 2017 at 11:36:40AM -0400, Gene Heskett wrote:
> > >    --binary-files=TYPE
>
> [...]
>
> > And that, while lots more typing, seems to duplicate the -I option.
>
> It does; actually, --binary-files=foo gives you some more control,
> depending on <foo>, whereas -I abbreviates one commonly used case,
> namely the "without-match" case.
>
> This pattern (long vs. short options; sometimes long options offer
> more knobs) is pervasive in the GNU utilities world, and has a
> historical reason.
>
> In the good ol' times, there were a few proprietary Unixes (AT&T,
> Sun's Xenix, what not), and they all came with their own set of
> utilities, with mixed quality and slightly incompatible options.
>
> The GNU toolset was installable on most unices and tried, as far as
> possible, to be downward-compatible to all of them (plus often being
> of higher quality: less bugs, less limitations. For one anecdote, the
> system's awk had a line length limit of 1K and silently (!) truncated
> longer lines; GNU awk just digested any line length you threw at it).
>
> Long story short, any sysadmin worth their salt ended up installing
> the GNU utils.
>
> This explains a bit that thicket of options you see nowadays, often
> with long and short variants (the systematized double dash for long,
> and single dash for short options is already GNU's attempt at taming
> the chaos: you'll see many vestigial variants, like the single-dash
> longs of find(1) et al).
>
> Then Linux came and most of the user space was there, waiting...
> (the success of the free BSDs and Linux wouldn't have been the same
> otherwise).
>
> > > My English module masters this (and it is pretty old too.
> > > Moreover, it was a cheap second-hand one, labelled "for
> > > foreigners" ;-)
> >
> > Chuckle... It is working very well, too. And I thank you for taking
> > the trouble to learn a language you didn't often hear growing up.
> > Had I stayed in school, the language class choices then were Latin
> > and French. But TBT, I didn't stick around, I had an allergy problem
> > which turned out to be milk when it was finally found, and my
> > algebra teacher was more interested in off-color standup comedy than
> > in teaching algebra, so in 1948 there was a job market for tv
> > repairmen, so I quit and went to work. Fixing these new-fangled
> > things they called tv sets.  I was 14. So I was a geek before the
> > word was invented. :) But now I'm an just old geezer that can regale
> > you with stories about some of the BTDT's I've done. :)  And I've
> > learned something useful today, thanks to you and Reco.
>
> Hey, thank you for taking my snark in such a sporty way :-)
>
> Cheers
> -- tomás

Snark, usually w/o the smileys, is also one of my talents. But you can't 
see me grinning, so...  :)

Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#187444

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Oct 01, 2017 at 07:43:47AM -0400, Gene Heskett wrote:
> On Sunday 01 October 2017 03:34:19 tomas@tuxteam.de wrote:
> 
> > On Sun, Oct 01, 2017 at 01:28:39AM -0400, Gene Heskett wrote:
> >
> > [...]
> >
> > > > > Assuring that my port is not in this IANA list is not enough to
> > > > > ensure that my port number will not clash with a port number
> > > > > used by a Debian package (by default).
> > > > >
> > > > > So your answer to my question is wrong.
> > >
> > > In which case debian should publish the unlisted ports they do use,
> > > if for no other reason than to "stake a claim".
> >
> > "Debian" "should". Gene, you "should" know better ;-)
> >
> > Want to start with it? Write a script which scans the /etc files in
> > all Debian packages for network configurations.
> >
> That might be possible IF you wanted to use a tool like grep, but in 30 
> years I've not found a way to silence the "binary file matches" messages 
> from grep. That apparently un-muffle-able noise without chaining two or 
> more invocations of grep makes it worthless for 95% of the searches I 
> might do. The best I can do finds 460 instances of " port " in my 
> own /etc tree, but from looking at that output, less than 100 actually 
> assign a number, most use the output of some other function to assign 
> the port.

Out of grep's fine manual:

       --binary-files=TYPE
              If the first few bytes of a file indicate that the
              file contains binary data, assume that the file is
              of type TYPE.  By default, TYPE is binary, and grep
              normally outputs either a one-line message saying
              that a binary file matches, or no message if there is
              no match.  If TYPE is without-match, grep assumes that
              a binary file does not match;  this  is  equivalent  to
              the  -I option.   If  TYPE  is text, grep processes
              a binary file as if it were text; this is equivalent
              to the -a option.  Warning: grep --binary-files=text
              might output binary garbage, which can have nasty side
              effects if the output is a terminal and if the terminal
              driver interprets some of it as commands.

So I'd try --binary-file=without-match (or its shorter cousin -I).

> So opening up every deb in /var/cache/apt/archives to search thru each 
> ones /etc files might take this machine a week or more, and you would 
> still have less than 25% of the numerical values. One things for sure, 
> it would take a more imaginative approach than mine because so much of 
> it appears to be dynamic assignments. One would have to emulate how each 
> goes about it, and then its only valid for that machine at that box of 
> time, however long it took.
> 
> However, since it seems so much of that is dynamic, one could possibly 
> use the dynamic method to find a currently unused server port when the 
> client requests a connection, and the client can check the number 
> assigned against its own list of ports, and accept or reject, wash rinse 
> repeat until one is usable by both.  Correctly done, I see at least 
> 20,000 possibilities in the /etc/services list. The OP just needs to 
> find a coder who can write such a critter.

Problem is, there are several such "dynamic" approaches. The older one
is Sun RPC's portmapper, which does have its downsides.

So my advice would be "relax". If there's a sysadmin around, just make
debugging of a clash easier, if not, look into all of those container/
orchestration frameworks, which have to tackle the problem more
systematically.

Cheers
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlnQ5EwACgkQBcgs9XrR2kZDcgCeKmFQ/WlViB2AXkptG94qslzr
NNcAnRMtsAzjPoPRHOQfOGZz79o0YJ49
=9WM+
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#187478

Gene Heskett wrote:
> On Sunday 01 October 2017 03:34:19 tomas@tuxteam.de wrote:
>
>> On Sun, Oct 01, 2017 at 01:28:39AM -0400, Gene Heskett wrote:
>>
>> [...]
>>
>> > > > Assuring that my port is not in this IANA list is not enough to
>> > > > ensure that my port number will not clash with a port number
>> > > > used by a Debian package (by default).
>> > > >
>> > > > So your answer to my question is wrong.
>> >
>> > In which case debian should publish the unlisted ports they do use,
>> > if for no other reason than to "stake a claim".
>>
>> "Debian" "should". Gene, you "should" know better ;-)
>>
>> Want to start with it? Write a script which scans the /etc files in
>> all Debian packages for network configurations.
>>
> That might be possible IF you wanted to use a tool like grep, but in 30 
> years I've not found a way to silence the "binary file matches" messages 
> from grep. [...]

`grep -a` will force grep to treat a file (regardless of data) as ascii
text.  Beware that a truely binary file will spit out the whole thing.


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#187436

[Multipart message — attachments visible in raw view] — view raw

The answer is correct - IANA maintains the list of ports. You may also look
at the services file nmap maintains or ask showdan what it's seen publicly
if you want a public popularity contest of ports.

As it is, I'm pretty sure you're over engineering this. Have a config file
that has a port range option and be done with it. Also, you didn't mention
needing <1024 so pick a port and be done with it (what everyone else does).

Lastly, certain ports are so old, their intended services shouldn't be
online anymore (see the first 20 ports or 90-110 - off the top of my head -
not sitting here and going through them) or if the service probably won't
be used in ICS or on a box designed to be an internet backbone, use one of
those.

On Sep 30, 2017 21:50, "Victor Porton" <porton@narod.ru> wrote:

> Alexander V. Makartsev wrote:
>
> > There is official list of all registered port numbers:
> > https://www.iana.org/assignments/service-names-
> port-numbers/service-names-port-numbers.txt
> >
> > You can choose any port that is not in the list, to be sure they won't
> > clash.
>
> The list of port numbers you pointed to me is a subset (or at least not a
> superset) of the full list used by Debian packages.
>
> Assuring that my port is not in this IANA list is not enough to ensure that
> my port number will not clash with a port number used by a Debian package
> (by default).
>
> So your answer to my question is wrong.
>
> > On 01.10.2017 06:04, Victor Porton wrote:
> >> We are going to install a range of software on a Debian Linux
> >> installation. Because we run the same software (such as Celery) several
> >> times, we need to use port numbers different than the standard Debian
> >> port numbers chosen by default (because we can't run more than one
> >> instance of a server with the same port, and thus using the standard
> port
> >> number for all servers would fail).
> >>
> >> How to choose TCP/IP port numbers for server software we run in such a
> >> way that they don't clash with "standard" Debian port numbers?
> >>
> >> In Debian are there any ranges of port numbers dedicated (so that they
> >> wouldn't clash with "standard" that is used by default port numbers) for
> >> servers configured by users?
> >>
> >> Note that we run (at least some of) our software not as root, so we
> can't
> >> use ports below 1024.
>
> --
> Victor Porton - http://portonvictor.org
>
>

[toc] | [prev] | [next] | [standalone]

#187477

shawn wilson wrote:
> [...]
> Lastly, certain ports are so old, their intended services shouldn't be
> online anymore (see the first 20 ports or 90-110 - off the top of my
> head - not sitting here and going through them) or if the service
> probably won't be used in ICS or on a box designed to be an internet
> backbone, use one of those.
>
Trouble with ports <1024 is that the process trying to use them will
need root permissions to bind to the port.  This may cause its own
fallout rather than using something in the upper range.

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#187482

On Mon, Oct 02, 2017 at 10:19:42AM -0000, Dan Purgert wrote:
>Trouble with ports <1024 is that the process trying to use them will
>need root permissions to bind to the port.  This may cause its own
>fallout rather than using something in the upper range.

And the advantage of such a port is that a user can't grab a port that 
you want to use the system. (An event which can cause its own fallout, 
as well as potentially being a security problem.) Luckily systemd makes 
it much easier to reserve a port early in the boot process so that's not 
as much of a problem as it used to be.

Mike Stone

[toc] | [prev] | [next] | [standalone]

#187440

Victor Porton wrote:

> We are going to install a range of software on a Debian Linux
> installation. Because we run the same software (such as Celery) several
> times, we need to use port numbers different than the standard Debian port
> numbers chosen by default (because we can't run more than one instance of
> a server with the same port, and thus using the standard port number for
> all servers would fail).
> 
> How to choose TCP/IP port numbers for server software we run in such a way
> that they don't clash with "standard" Debian port numbers?
> 
> In Debian are there any ranges of port numbers dedicated (so that they
> wouldn't clash with "standard" that is used by default port numbers) for
> servers configured by users?
> 
> Note that we run (at least some of) our software not as root, so we can't
> use ports below 1024.

It is your machine, so the question is, is this machine dedicated to
specific service, or you intend to install some other application later.

I usually take the ports that I want - you don't need to ask for permission
to do so.

I prefer using 8000 - 30000 range for servers and from 30001 - 61000 for
client communication.

You can reserve this range for yourself on the machine

# sysctl net.ipv4.ip_local_port_range
net.ipv4.ip_local_port_range = 32768    60999

This way all client communication will  use this range and you can configure
the servers to use therange 8000 - 32000

Forget the crap service list - just take into account what apps you are
running

regards

[toc] | [prev] | [next] | [standalone]

#187445

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Oct 01, 2017 at 03:44:45PM +0300, Victor Porton wrote:
> Victor Porton wrote:
> 
> > We are going to install a range of software on a Debian Linux
> > installation. Because we run the same software (such as Celery) several
> > times, we need to use port numbers different than the standard Debian port
> > numbers chosen by default (because we can't run more than one instance of
> > a server with the same port, and thus using the standard port number for
> > all servers would fail).
> > 
> > How to choose TCP/IP port numbers for server software we run in such a way
> > that they don't clash with "standard" Debian port numbers?
> > 
> > In Debian are there any ranges of port numbers dedicated (so that they
> > wouldn't clash with "standard" that is used by default port numbers) for
> > servers configured by users?
> > 
> > Note that we run (at least some of) our software not as root, so we can't
> > use ports below 1024.
> 
> I received no satisfactory answer.
> 
> So I feel that there is no Debian policy on using port numbers.
> 
> This policy should be added to Debian!

I don't think so. I don't even think there is a policy which could ever
cater to the ~50K packages present in Debian.

Cheers
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlnQ5WQACgkQBcgs9XrR2kZApwCfbJR0fajOhynmZv3RUqRYBmzh
BpQAn01L1bDFJevwhZtWFPSnZzGR79cz
=BD/R
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#187446

Victor Porton wrote:

> We are going to install a range of software on a Debian Linux
> installation. Because we run the same software (such as Celery) several
> times, we need to use port numbers different than the standard Debian port
> numbers chosen by default (because we can't run more than one instance of
> a server with the same port, and thus using the standard port number for
> all servers would fail).
> 
> How to choose TCP/IP port numbers for server software we run in such a way
> that they don't clash with "standard" Debian port numbers?
> 
> In Debian are there any ranges of port numbers dedicated (so that they
> wouldn't clash with "standard" that is used by default port numbers) for
> servers configured by users?
> 
> Note that we run (at least some of) our software not as root, so we can't
> use ports below 1024.

I received no satisfactory answer.

So I feel that there is no Debian policy on using port numbers.

This policy should be added to Debian!

It may be something like: "Debian packages (with default configuration) are 
allowed to bind ports 1-10000. Ports 10001-32000 are available for users."

Please discuss.

-- 
Victor Porton - http://portonvictor.org

[toc] | [prev] | [next] | [standalone]

#187448

On Sun, Oct 01, 2017 at 03:44:45PM +0300, Victor Porton wrote:
>I received no satisfactory answer.
>
>So I feel that there is no Debian policy on using port numbers.
>
>This policy should be added to Debian!
>
>It may be something like: "Debian packages (with default configuration) are
>allowed to bind ports 1-10000. Ports 10001-32000 are available for users."

It isn't really possible to do this, because of the need to interoperate 
with other systems. IANA may assign ports in the range 0 through 49151. 
Currently Debian/Linux uses 32768 through 60999 for ephemeral ports. 
(Note the overlap there!) You can try using 61001 through 65534 as 
a range that's fairly unlikely to be assigned to anything, assuming 
nobody changes net.ipv4.ip_local_port_range, and with the knowledge that 
using such a range could cause interoperability problems if some of the 
servers use other operating systems (that might use that range for 
ephemeral ports).

Mike Stone

[toc] | [prev] | [next] | [standalone]

#187553

[Multipart message — attachments visible in raw view] — view raw

On Sun, Oct 1, 2017 at 7:44 AM, Victor Porton <porton@narod.ru> wrote:
>
>
> I received no satisfactory answer.
> So I feel that there is no Debian policy on using port numbers.
> This policy should be added to Debian!
> It may be something like: "Debian packages (with default configuration) are
> allowed to bind ports 1-10000. Ports 10001-32000 are available for users."
> Please discuss.


Trying to return to the original subject....
If this is a server environment, you should already know which ports are
open and
in use in your network. There should be no mysteries. Files identifying
configured
port numbers, especially if you have numerous local values, should be
placed
under source-control and distributed/maintained by configuration management
software like salt, puppet, etc. This is the only way that good consistency
can
be maintained, but it affords you great flexibility.

WRT the "no Debian policy on using port numbers", the only authority, so
far as it
goes, is the IANA. Every site may choose to respect or ignore those values
within
the limits of their installed software base and configurability of
applications. Debian
can't really influence that state of affairs and any claims it stakes to
certain ports
are simply going to be ignored in most cases.


> --
> Victor Porton - http://portonvictor.org
>
>

[toc] | [prev] | [next] | [standalone]

#187494

On Monday 02 October 2017 10:04:05 Reco wrote:

> 	Hi.
>
> On Mon, Oct 02, 2017 at 09:39:38AM -0400, Greg Wooledge wrote:
> > On Sun, Oct 01, 2017 at 05:47:52PM +0300, Reco wrote:
> > > Patches are welcome. File a bug against "grep" package, make a
> > > world a better place.
> >
> > It has been my experience, in general, that man page patches are
> > rarely welcome.  Especially by Debian packagers of programs that get
> > their man pages from upstream.
> >
> > If the program is written *by* Debian, then there may be a chance,
> > but this is not the case with GNU grep.
>
> What benefits the community more - a (possibly) deserved rant in a
> maillist, or a patch in Debian bugtracker?
>
The former gets read by more eyes, and possibly warns others who will 
never read the bugtracker.  And make me feel better. ;-) My own 
interfacing with the bug tracker back in my fedora 1 and 2 days was less 
than a satisfying experience.

> Reco


Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#187505

	Hi.

On Mon, Oct 02, 2017 at 10:23:36AM -0400, Gene Heskett wrote:
> On Monday 02 October 2017 10:04:05 Reco wrote:
> 
> > 	Hi.
> >
> > On Mon, Oct 02, 2017 at 09:39:38AM -0400, Greg Wooledge wrote:
> > > On Sun, Oct 01, 2017 at 05:47:52PM +0300, Reco wrote:
> > > > Patches are welcome. File a bug against "grep" package, make a
> > > > world a better place.
> > >
> > > It has been my experience, in general, that man page patches are
> > > rarely welcome.  Especially by Debian packagers of programs that get
> > > their man pages from upstream.
> > >
> > > If the program is written *by* Debian, then there may be a chance,
> > > but this is not the case with GNU grep.
> >
> > What benefits the community more - a (possibly) deserved rant in a
> > maillist, or a patch in Debian bugtracker?
> >
> The former gets read by more eyes, and possibly warns others who will 
> never read the bugtracker.  And make me feel better. ;-) My own 
> interfacing with the bug tracker back in my fedora 1 and 2 days was less 
> than a satisfying experience.

But the eyes that are viewing bugtracker usually come attached to hands,
which in turn have an access to a commit bit.
Bugtracker, no matter how ugly - [1], unsatisfying - [2] or weird - [3]
it is - is a small price to pay to achieve greater good.

[1] https://bugzilla.redhat.com/

[2] https://bugs.debian.org

[3] https://bugzilla.suse.com

Reco

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web