Watchguard Firebox X1000, Reference Manual

Page: 20 / 264

CHAPTER 1: Internet Protocol Reference
8 WatchGuard Firebox System
• A connection is described by its source and destination ports and its
source and destination IP addresses. In typical usage, port numbers
below 1024 are reserved for well-known services (destinations), and
the client side is supposed to use ports above 1023 for the source of
the connection. However, this rule has many notable exceptions. In
particular, NFS (port 2049) and Archie (port 1525) use server ports at
numbers above 1024. Some services use the same source and
destination port for server-to-server connections. Common examples
are DNS (53), NTP (123), syslog (514), and RIP (520).
TCP
Transmission Control Protocol (TCP) provides reliable stream-oriented
services. It trades speed and overhead for increased reliability. Like UDP,
TCP provides source and destination ports that are used in a similar
fashion.
TCP uses a rather complicated state machine to manage connections.
There are several attribute bits that control the state of a connection. Three
very important attribute bits of TCP packets are the SYN, ACK, and FIN
bits. The SYN bit is set only on the first packet sent in each direction for a
given connection. The ACK bit is set when the other side is
acknowledging the receipt of data to the peer. The FIN bit is set when
either side chooses to close the connection.
ICMP
The Internet Control Message Protocol (ICMP) is used primarily to
deliver error information about other services. It is otherwise quite similar
in practical operation to UDP. That is, it is connectionless and does not
guarantee that packets are delivered to their destination. One dangerous
ICMP packet is the ICMP redirect packet, which can change routing
information on the machines that receive it.
Other protocols
The vast majority of the traffic on the Internet uses one of the three
protocols mentioned in the previous section. Some other protocols are as
follows: