Re: UDP port conflict

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Max Paklin (mpaklin_at_hotmail.com)
Date: 09/15/04 

Date: Wed, 15 Sep 2004 05:16:55 -0700

Oh, Marc you turned out to be correct with your guess that it is firewall
playing games.
This is what I found out. The following sequence manifests the problem.

1. install fresh XP
2. update it with SP2
3. have firewall on
4. get free FAR utility and open any FTP site with FAR FTP client
5. use Simple Winsock sample from the Platform SDK to bind to UDP port 5001
on 0.0.0.0

This sequence makes Winsock sample fail.
Without firewall it works. Without FAR FTP client it works too. To me it
looks like firewall going nuts for no particular reason. I am pretty sure
that FAR doesn't use UDP 500x. Moreover the problem persists even after I
shut down FAR application, which assumes that all sockets have been closed.

When I said that I tried it without firewall I wasn't lying. I did try it
and it didn't change anything. However reboot after disabling firewall
helps, while on-the-fly firewall enable/disable doesn't fix the situation.

Anyways, it looks to me as a bug in either firewall or the network stack. I
will try to follow on this problem with the next OS or SP beta.

-- Max.

"Marc Reinig" <Marco@newsgroups.nospam> wrote in message
news:OR5JgI3lEHA.324@TK2MSFTNGP11.phx.gbl...
> Have you tried disabling the Firewall that is installed by default with XP
> SP2?
>
> Marc Reinig
>
> "Max Paklin" <mpaklin@hotmail.com> wrote in message
> news:epoU0ohlEHA.3520@TK2MSFTNGP11.phx.gbl...
>>I am trying to figure out the source of UDP port conflict on XP SP2
>>machine.
>> As far as I can tell this is new SP2 as the very same setup works fine on
>> Win2K SP3-SP4, WinXP Gold/SP1, 2003 Server.
>>
>> What I have is a TDI client trying to bind to UDP port 5001. Our newer
>> firmware on the device side supports dynamic port assignment, but legacy
>> devices simply select port 5001 and use it for communication with the
>> host (it is lab equipment, so the distribution is VERY limited).
>>
>> What I see is that sometimes on certain SP2 machines an attempt to bind
>> to port 5001 fails. Out of curiousity I wrote a simple Sockets app to do
>> socket() => bind(0.0.0.0:5001) or bind(local IP:5001) and sure enough it
>> didn't work either.
>>
>> Dynamic port allocation starts with 5001 and goes up to 5033, which
>> finally succeeds. Starting with 5033 or 5000 always succeeds right away.
>> So it appears as though somebody claimed port range from 5001 up to 5032.
>>
>> I have two questions
>>
>> 1. does anybody know who and why would claim 5001-5032 (the machine is
>> CLEAN, nothing is installed or running on it besides our suite)
>>
>> 2. how can I figure out who is attached to a given UDP port? Netstat
>> doesn't show anybody on 50xx.
>>
>> The fact that the problem comes and goes indicates that we are somehow
>> leaking sockets, but what puzzles me is that it never happened prior SP2.
>> Any ideas would be appreciated.
>>
>> Thanks,
>> -- Max.
>>
>>
>
>

Relevant Pages

  • Re: skype and NAT
    ... Does the firewall think the UDP port on that IP address is still open? ... Suppose some outsider then tries to send packets to the firewall, ... machine because if it were than it couldn't have been used by Skype. ...
    (comp.os.linux.networking)
  • Re: Block UDP Ports?
    ... > I was just busy probing my firewall using NMAP and I did a UDP port scan ... Your firewall sux. ...
    (comp.security.firewalls)
  • Re: Hacked?
    ... :Recently while checking my firewall log, I found that some of my NT ... :outside and those servers have nothing to do with outside, ... :servers were starting connections at udp port 137 from time to time!! ...
    (comp.security.misc)
  • Re: ActiveSync and Firewall SP2 (what is the true answer)
    ... disabling the firewall, b) wirelessly synchronizing and c) enabling the firewall. ... Enabling F&PS, which also enables UDP Port 137, allowed the user to enable the SP2 ...
    (microsoft.public.pocketpc.activesync)
  • Re: Block UDP Ports?
    ... :> I was just busy probing my firewall using NMAP and I did a UDP port scan ... :> ports, in fact it said they were all open. ... Your firewall sux. ... Does your rulebase have a stealth rule in place [this is the rule to control ...
    (comp.security.firewalls)