[44387] in North American Network Operators' Group
Re: Slightly OT: Anyone know of a concise port list
daemon@ATHENA.MIT.EDU (k claffy)
Wed Nov 21 18:25:31 2001
Date: Wed, 21 Nov 2001 15:24:54 -0800
From: k claffy <kc@ipn.caida.org>
To: Fred True <ft@research.att.com>
Cc: nanog@merit.edu
Message-ID: <20011121152454.A2706@caida.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.SOL.4.33.0111211627030.9790-100000@windsor.research.att.com>; from ft@research.att.com on Wed, Nov 21, 2001 at 04:27:36PM -0500
Errors-To: owner-nanog-outgoing@merit.edu
might also check out
http://www.portsdb.org/
and
coralreef's list:
http://www.caida.org/tools/measurement/coralreef/dists/coral-3.4.7-public.tar.gz
(untar; get from etc/Application_ports_Master.txt)
k
On Wed, Nov 21, 2001 at 04:27:36PM -0500, Fred True wrote:
> Anyone know of a concise port/port range list for profiling various client
> code out their (no /etc/services isn't the end all). Looking for ranges for
> Napster, Audio Galaxy, BearShare, etc, besides the WKP's.
We've been tracking this dynamically for a while in order to make sense of
flow data traces - using a plethora of reliable (as well as dubious!)
sources - including running some of the more popular p2p apps to see what
ports they choose. Of course, there are many problems with using tcp/udp
ports to identify apps - some apps use randomly assigned ports (sometimes
after negotiating the connection on a well known port; like most streaming
video protocols); some apps allow users to override ports, which many
users do in order to circumvent firewalls; and there is much duplication
across ports.
But, try the attached lists (one by port, one by app, and one shows a
grouping we use for "common application classes" e.g. "mail" or "peer to
peer" etc.). I'd greatly appreciate fixes or updates. [NOTE: attachments
not sent to nanog-post - if you want them, email me privately.]
Of course if you really want to accurately account for traffic by
application, there is no substitute for passive sniffing of full headers
(not scaleable, and certainly can raise privacy issues).
-fred
