Firewall Port Summary

Comments

1. 

   Blaine Simpson

   This table really needs to specify the IP level protocol such as ICMP vs. UDP vs. TCP. Is the reader supposed to assume that TCP is meant unless the record obviously indicates otherwise, such as the "ICMP Echo" entry?

   May 07, 2012 07:53

   1. 

      Charles Oldham

      Yes, exactly that.

      The only non TCP entry above that is not an otherwise well known protocol is port 4. As port 4 is unusual it's explained in the link, and the opening paragraph makes it clear that this is only a summary and the links provided provide more detail where needed.

      Too many columns will make the page very difficult to read and I decided that it is more important for firewall admins to understand the direction the port is going to be opened in than the protocol; if they don't know what ICMP and SNMP is they probably shouldn't be maintaining security critical firewalls.

      May 08, 2012 04:42

      1. 

         Blaine Simpson

         A lot of people use this table who are not strictly firewall admins. People in security and other roles use this table to gauge risk or upcoming work, and afterwards for troubleshooting purposes. But besides that, because a port is "well known" does not mean that TCP vs. UDP for that service is well known. There are lots of firewall admins who rely on the documentation at hand to know whether Corba, JMX, NTP, etc. are TCP vs. UDP, especially in the several cases where the relevant specs allows for both UDP and TCP but only one is used in typical setups. Following the links provided here do not answer these questions.

         Agreed that another full column here would be bad, but that's not the only way to provide the information. Reference documentation should be complete. Can't we afford a few asterisks and a footnote?

         Another example where clients often need to know but it is not documented anywhere I can find, is whether the 111 + (presumably non-system) ports used by CMDB default Remedy portmapper connections are UDP or TCP; and same question if CMDB is configured to use a single port. We should make basic information which is needed for basic network security configuration easily accessible. We shouldn't have to research details of "CMDB Protocol" to administer ADDM.

         May 08, 2012 06:29