Wireshark · Wireshark-dev: Re: [Wireshark-dev] About transport name resolution with the new services file

[Andrew Hood <ajhood@xxxxxxxxx>]

Francois-Xavier Le Bail wrote:
> --- Andrew Hood <ajhood@xxxxxxxxx> wrote:
>>It it wasn't for Windows' broken behaviour in
>>letting any port be
>>ephemeral, that might make some sense.
>>
>>I have been forced to set registry values to make
>>Windows behave more
>>like *nix. Reserve all ports below 32768. Make
>>ephemerals be 32768-49151.
>>
>>Windows Registry Editor Version 5.00
>>
>>
> 
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
> 
> "ReservedPorts"=hex(7):31,00,2d,00,33,00,32,00,37,00,36,00,37,00,00,00,00,00
> 
>>"MaxUserPort"=dword:0000bfff
>>
>>Even that doesn't protect all "REGISTERED PORT
>>NUMBERS". That would
>>require setting "ReservedPorts" to be 1-49151, and
>>"MaxUserPort" to
>>something like 57344 (8192 available ephemerals) or
>>61440 (12288
>>available ephemerals).
> 
> 
> Windows' broken behaviour ? It's the same with Linux
> 2.4.27, 2.6.16, ...

I have several Linux, AIX, Solaris and HP-UX versions.

None of them by default allow ephemeral ports below 16384, and most of
them do not allow ephemerals below 32768.

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who