Which ephemeral ports are used with raw sockets

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
0
down vote

favorite












Referring to How source ports get assigned, I do know, how the local port is determined. (=> Random free ephemeral port).



However, why does my raw socket using socket(AF_INET, SOCK_RAW, IPPROTO_TCP) get port 6 assigned?



ss -lnp shows: tcp UNCONN 0 0 0.0.0.0:6 0.0.0.0:* users:(("exe",pid=13164,fd=5))



Do I create the socket incorrectly (because IPPROTO_TCP is defined with =6 in linux/in.h)? Or are RAW_SOCKETS defaulted to port 6 if available?



I am Using Ubuntu 4.15 if that's important.










share|improve this question





















  • Raw sockets are not port specific, but protocol specific (they can be used to implement new IP protocols in user space) so I strongly suspect the protocol is encoded in what ss shows as the port. It's easy to test: Use a different protocol (including unassigned numbers) and have a look at what ss shows. Or use nc etc. to send a few TCP packets to/from unrelated ports and see if you receive them.
    – dirkt
    Sep 19 at 11:15










  • If I understood correctly, the 6 in ss just seem to tell me, that I used IPPROTO_TCP... yes. Using socket(AF_INET, SOCK_RAW, 123) ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3)) so it makes sense. I'll write this as an answer.
    – Joel
    Sep 19 at 11:25














up vote
0
down vote

favorite












Referring to How source ports get assigned, I do know, how the local port is determined. (=> Random free ephemeral port).



However, why does my raw socket using socket(AF_INET, SOCK_RAW, IPPROTO_TCP) get port 6 assigned?



ss -lnp shows: tcp UNCONN 0 0 0.0.0.0:6 0.0.0.0:* users:(("exe",pid=13164,fd=5))



Do I create the socket incorrectly (because IPPROTO_TCP is defined with =6 in linux/in.h)? Or are RAW_SOCKETS defaulted to port 6 if available?



I am Using Ubuntu 4.15 if that's important.










share|improve this question





















  • Raw sockets are not port specific, but protocol specific (they can be used to implement new IP protocols in user space) so I strongly suspect the protocol is encoded in what ss shows as the port. It's easy to test: Use a different protocol (including unassigned numbers) and have a look at what ss shows. Or use nc etc. to send a few TCP packets to/from unrelated ports and see if you receive them.
    – dirkt
    Sep 19 at 11:15










  • If I understood correctly, the 6 in ss just seem to tell me, that I used IPPROTO_TCP... yes. Using socket(AF_INET, SOCK_RAW, 123) ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3)) so it makes sense. I'll write this as an answer.
    – Joel
    Sep 19 at 11:25












up vote
0
down vote

favorite









up vote
0
down vote

favorite











Referring to How source ports get assigned, I do know, how the local port is determined. (=> Random free ephemeral port).



However, why does my raw socket using socket(AF_INET, SOCK_RAW, IPPROTO_TCP) get port 6 assigned?



ss -lnp shows: tcp UNCONN 0 0 0.0.0.0:6 0.0.0.0:* users:(("exe",pid=13164,fd=5))



Do I create the socket incorrectly (because IPPROTO_TCP is defined with =6 in linux/in.h)? Or are RAW_SOCKETS defaulted to port 6 if available?



I am Using Ubuntu 4.15 if that's important.










share|improve this question













Referring to How source ports get assigned, I do know, how the local port is determined. (=> Random free ephemeral port).



However, why does my raw socket using socket(AF_INET, SOCK_RAW, IPPROTO_TCP) get port 6 assigned?



ss -lnp shows: tcp UNCONN 0 0 0.0.0.0:6 0.0.0.0:* users:(("exe",pid=13164,fd=5))



Do I create the socket incorrectly (because IPPROTO_TCP is defined with =6 in linux/in.h)? Or are RAW_SOCKETS defaulted to port 6 if available?



I am Using Ubuntu 4.15 if that's important.







networking kernel port






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Sep 19 at 11:02









Joel

1216




1216











  • Raw sockets are not port specific, but protocol specific (they can be used to implement new IP protocols in user space) so I strongly suspect the protocol is encoded in what ss shows as the port. It's easy to test: Use a different protocol (including unassigned numbers) and have a look at what ss shows. Or use nc etc. to send a few TCP packets to/from unrelated ports and see if you receive them.
    – dirkt
    Sep 19 at 11:15










  • If I understood correctly, the 6 in ss just seem to tell me, that I used IPPROTO_TCP... yes. Using socket(AF_INET, SOCK_RAW, 123) ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3)) so it makes sense. I'll write this as an answer.
    – Joel
    Sep 19 at 11:25
















  • Raw sockets are not port specific, but protocol specific (they can be used to implement new IP protocols in user space) so I strongly suspect the protocol is encoded in what ss shows as the port. It's easy to test: Use a different protocol (including unassigned numbers) and have a look at what ss shows. Or use nc etc. to send a few TCP packets to/from unrelated ports and see if you receive them.
    – dirkt
    Sep 19 at 11:15










  • If I understood correctly, the 6 in ss just seem to tell me, that I used IPPROTO_TCP... yes. Using socket(AF_INET, SOCK_RAW, 123) ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3)) so it makes sense. I'll write this as an answer.
    – Joel
    Sep 19 at 11:25















Raw sockets are not port specific, but protocol specific (they can be used to implement new IP protocols in user space) so I strongly suspect the protocol is encoded in what ss shows as the port. It's easy to test: Use a different protocol (including unassigned numbers) and have a look at what ss shows. Or use nc etc. to send a few TCP packets to/from unrelated ports and see if you receive them.
– dirkt
Sep 19 at 11:15




Raw sockets are not port specific, but protocol specific (they can be used to implement new IP protocols in user space) so I strongly suspect the protocol is encoded in what ss shows as the port. It's easy to test: Use a different protocol (including unassigned numbers) and have a look at what ss shows. Or use nc etc. to send a few TCP packets to/from unrelated ports and see if you receive them.
– dirkt
Sep 19 at 11:15












If I understood correctly, the 6 in ss just seem to tell me, that I used IPPROTO_TCP... yes. Using socket(AF_INET, SOCK_RAW, 123) ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3)) so it makes sense. I'll write this as an answer.
– Joel
Sep 19 at 11:25




If I understood correctly, the 6 in ss just seem to tell me, that I used IPPROTO_TCP... yes. Using socket(AF_INET, SOCK_RAW, 123) ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3)) so it makes sense. I'll write this as an answer.
– Joel
Sep 19 at 11:25










1 Answer
1






active

oldest

votes

















up vote
1
down vote



accepted










As @dirkt commented, the socket is not-port bound and displays the protocol aftert the local IP instead of the port (which is not there obviously).



using socket(AF_INET, SOCK_RAW, 123), ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3))



Also, testing with other numbers as the third argument to socket(), ss shows that as the local port.






share|improve this answer




















    Your Answer







    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "106"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    convertImagesToLinks: false,
    noModals: false,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













     

    draft saved


    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f469989%2fwhich-ephemeral-ports-are-used-with-raw-sockets%23new-answer', 'question_page');

    );

    Post as a guest






























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes








    up vote
    1
    down vote



    accepted










    As @dirkt commented, the socket is not-port bound and displays the protocol aftert the local IP instead of the port (which is not there obviously).



    using socket(AF_INET, SOCK_RAW, 123), ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3))



    Also, testing with other numbers as the third argument to socket(), ss shows that as the local port.






    share|improve this answer
























      up vote
      1
      down vote



      accepted










      As @dirkt commented, the socket is not-port bound and displays the protocol aftert the local IP instead of the port (which is not there obviously).



      using socket(AF_INET, SOCK_RAW, 123), ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3))



      Also, testing with other numbers as the third argument to socket(), ss shows that as the local port.






      share|improve this answer






















        up vote
        1
        down vote



        accepted







        up vote
        1
        down vote



        accepted






        As @dirkt commented, the socket is not-port bound and displays the protocol aftert the local IP instead of the port (which is not there obviously).



        using socket(AF_INET, SOCK_RAW, 123), ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3))



        Also, testing with other numbers as the third argument to socket(), ss shows that as the local port.






        share|improve this answer












        As @dirkt commented, the socket is not-port bound and displays the protocol aftert the local IP instead of the port (which is not there obviously).



        using socket(AF_INET, SOCK_RAW, 123), ss outputs ??? UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("exe",pid=10039,fd=3))



        Also, testing with other numbers as the third argument to socket(), ss shows that as the local port.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Sep 19 at 11:29









        Joel

        1216




        1216



























             

            draft saved


            draft discarded















































             


            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f469989%2fwhich-ephemeral-ports-are-used-with-raw-sockets%23new-answer', 'question_page');

            );

            Post as a guest













































































            Popular posts from this blog

            How to check contact read email or not when send email to Individual?

            Displaying single band from multi-band raster using QGIS

            How many registers does an x86_64 CPU actually have?