Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just did a packet capture from my machine and filtered out all the UDP connections. I saw certain connections using what appears to be a randomly generated UDP Source port, and certain connection using the same Source port as the UDP Destination Port.

I understand that TCP connections will randomize the source port so the response has a "dedicated" port to respond to. But how does it work with UDP?

I'm looking for the authoritative answer. Links to RFC's (or whatnot) would be greatly appreciated.

What determines the UDP Source port?

  • Is it randomly generated when a response is expected?
  • Does it match the destination port when no response is expected? (instead of using 0 as a source port)?

Thank you.

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

It depends on the application. For example, the Linux kernel implemented UDP source port randomization when no source port is specified in kernel 2.6.24.

So, the behavior you are seeing in some connections must be the particular application specifying the source port to be the same as the destination port, while others are leaving it to the kernel.

share|improve this answer
    
So what you are saying (to ensure I understand) is by default, UDP will randomize source ports (just like TCP) unless the service/application itself calls for something special, to include using matching source/destination ports. Is that right? –  Eddie Dec 15 '11 at 17:20
    
That is correct depending on the platform. –  Jeff Strunk Dec 15 '11 at 19:03
add comment

Ephemeral ports are generated for UDP packets the same as TCP.

http://www.hsc.fr/ressources/articles/win_net_srv/ephem_port_alloc.html

share|improve this answer
    
But not always, as my packet capture indicated. What makes some connections use a random UDP source port, and others matching the destination port? And when they do match, how does that affect return traffic? –  Eddie Dec 15 '11 at 17:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.