what is sae-urn udp port 4500??

[John Smith]

does anyone know what this is??
it showed up during a udp port scan w/ nmap...




ps - i should admit it was on an openbsd3.6/sparc64 box. i posted to an
openbsd newsgroup, but it doesn't get much hits.


TIA

[Torfinn Ingolfsen]

Post by John Smith
does anyone know what this is??
it showed up during a udp port scan w/ nmap...

According to the offical source, this is for IPSec NAT Traversal:

***@kg-work$ rfc -n 4500
Looking up service...
sae-urn 4500/tcp #
sae-urn 4500/udp #

***@kg-work$ rfc -p port 4500
Making connection to server....
http://www.iana.org/assignments/port-numbers
ipsec-nat-t 4500/tcp IPsec NAT-Traversal
ipsec-nat-t 4500/udp IPsec NAT-Traversal
# RFC-ietf-ipsec-nat-t-ike-08.txt

Googling on that gives this reference:
http://www.iana.org/assignments/isakmp-registry

and in ther you will find a refernce to "RFC-ietf-ipsec-nat-t-ike-08.txt"

The rest is an exercise for the reader.

[Per Hedeland]

Post by John Smith
does anyone know what this is??
it showed up during a udp port scan w/ nmap...

Well, Torfinn already answered the question you actually asked - which
may not have been the question you *should* have asked... You need to
realize that the fact that a port is formally "reserved" for some
particular purpose is no guarantee that it isn't being used for
something else on *your* box, in particular when you get above 1023.

Use 'sockstat -l46 -p 4500' to find the actual process listening on that
port - figuring out what it is from that may well be more useful.

Post by John Smith
ps - i should admit it was on an openbsd3.6/sparc64 box. i posted to an
openbsd newsgroup, but it doesn't get much hits.

I don't know if OpenBSD has 'sockstat', but probably - if not you can
use 'lsof -p 4500' instead, though it may require that you first install
'lsof'.

--Per Hedeland
***@hedeland.org

[Per Hedeland]

Post by Per Hedeland
I don't know if OpenBSD has 'sockstat', but probably - if not you can
use 'lsof -p 4500' instead, though it may require that you first install
'lsof'.

Uh, that should be 'lsof -i :4500' of course.

--Per Hedeland
***@hedeland.org