Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just did a packet capture from my machine and filtered out all the UDP connections. I saw certain connections using what appears to be a randomly generated UDP Source port, and certain connection using the same Source port as the UDP Destination Port.

I understand that TCP connections will randomize the source port so the response has a "dedicated" port to respond to. But how does it work with UDP?

I'm looking for the authoritative answer. Links to RFC's (or whatnot) would be greatly appreciated.

What determines the UDP Source port?

  • Is it randomly generated when a response is expected?
  • Does it match the destination port when no response is expected? (instead of using 0 as a source port)?

Thank you.

share|improve this question
up vote 3 down vote accepted

It depends on the application. For example, the Linux kernel implemented UDP source port randomization when no source port is specified in kernel 2.6.24.

So, the behavior you are seeing in some connections must be the particular application specifying the source port to be the same as the destination port, while others are leaving it to the kernel.

share|improve this answer
So what you are saying (to ensure I understand) is by default, UDP will randomize source ports (just like TCP) unless the service/application itself calls for something special, to include using matching source/destination ports. Is that right? – Eddie Dec 15 '11 at 17:20
That is correct depending on the platform. – Jeff Strunk Dec 15 '11 at 19:03

Ephemeral ports are generated for UDP packets the same as TCP.

share|improve this answer
But not always, as my packet capture indicated. What makes some connections use a random UDP source port, and others matching the destination port? And when they do match, how does that affect return traffic? – Eddie Dec 15 '11 at 17:22
This answer specifically describes Windows behavior. The other answer is about Linux behavior. Assuming these are still up to date it looks like Windows does not randomise by default like Linux does. – thomasrutter Apr 14 at 11:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.