8

I just did a packet capture from my machine and filtered out all the UDP connections. I saw certain connections using what appears to be a randomly generated UDP Source port, and certain connection using the same Source port as the UDP Destination Port.

I understand that TCP connections will randomize the source port so the response has a "dedicated" port to respond to. But how does it work with UDP?

I'm looking for the authoritative answer. Links to RFC's (or whatnot) would be greatly appreciated.

What determines the UDP Source port?

  • Is it randomly generated when a response is expected?
  • Does it match the destination port when no response is expected? (instead of using 0 as a source port)?

Thank you.

2 Answers 2

6

It depends on the application. For example, the Linux kernel implemented UDP source port randomization when no source port is specified in kernel 2.6.24.

So, the behavior you are seeing in some connections must be the particular application specifying the source port to be the same as the destination port, while others are leaving it to the kernel.

3
  • So what you are saying (to ensure I understand) is by default, UDP will randomize source ports (just like TCP) unless the service/application itself calls for something special, to include using matching source/destination ports. Is that right?
    – Eddie
    Dec 15, 2011 at 17:20
  • That is correct depending on the platform. Dec 15, 2011 at 19:03
  • +1 This is correct; unlike with TCP, where you don't have control over the source port (since OS must ensure it's unique for each socket), in UDP the application is free to configure it to whatever it likes. If there is two-way communication, it would be "reasonable" that the source port should be the port where the other party should reply to (stated in Wikipedia under "Source port number"). However, whoever wrote the application might have easily chosen to use a random number instead.
    – vgru
    Jan 24, 2017 at 10:48
0

Ephemeral ports are generated for UDP packets the same as TCP.

http://www.hsc.fr/ressources/articles/win_net_srv/ephem_port_alloc.html

2
  • But not always, as my packet capture indicated. What makes some connections use a random UDP source port, and others matching the destination port? And when they do match, how does that affect return traffic?
    – Eddie
    Dec 15, 2011 at 17:22
  • This answer specifically describes Windows behavior. The other answer is about Linux behavior. Assuming these are still up to date it looks like Windows does not randomise by default like Linux does. Apr 14, 2016 at 11:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .