> -----Original Message-----
> From: Wookey [mailto:[EMAIL PROTECTED]]
> Sent: 31 May 1999 17:14
[snip]
> > The number separated by a comma from
> > the IP address is the port number of the service used, as
> allocated in
> > /etc/services.
>
> OK, that's what I thought, but I don't understand why when I monitor
> packets the 'to' port is usually something sensible, like '25' (SMTP),
> but the 'from' port is usually something like 6586, which is way off the
> end of my /etc/services list. I had wondered if it was a pid not a port,
> but that didn't seem to pan out either. So why these large port numbers?
> I get feeling I am missing something fundamental...
I think you are. Port numbers below 1024 are the socalled 'reserved' or
'privileged' numbers - also known as 'known ports' . They are allocated
for specific purposes, such as smtp, ntp etc. The allocated usages are
listed in /etc/services. There is an RFC that describes this.
If I wish to talk to port 25 on a specific host I will simply allocate
any port >1024 on my own system, but set it up to talk to port 25 on
the remote system.
A port number is a half-word, so you can see values 1025-65535.
>
>> I haven't yet found a way to identify which process is
>> responsible for each
>> packet. If anyone knows how to find the PID of the process
>> sending or receiving
>> a given packet (and presumably this involves finding out
>> which socket it is
>> going to or coming from, and separately identifying the
>> process which is using
>> that socket) ... PLEASE let me know.
>
> yes, I'd like to know that too...
Indeed - that would a very handy piece of information. I suspect
you'd have to go search through the file-descriptors (there is one
for each open file or socket), but this requires going deeper into
the Linux IP-layer than I currently plan to do :-)
regards,
Per Jessen, ENIDAN Technologies, London
-
To unsubscribe from this list: send the line "unsubscribe linux-diald" in
the body of a message to [EMAIL PROTECTED]
