Internet Architecture Board M. StJohns, Ed.
Internet-Draft G. Huston, Ed.
Expires: June 27, 2003 IAB
December 27, 2002
Considerations on the use of a Service Identifier in Packet Headers
draft-iab-service-id-considerations-00
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at http://
www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on June 27, 2003.
Copyright Notice
Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract
This memo describes some considerations relating to the use of IP
protocol number fields and payload protocol (e.g. TCP) port fields
to identify particular services that may be associated with that port
number or protocol number.
1. Introduction
This memo describes some considerations relating to the use of IP
protocol number fields and payload protocol (e.g. TCP) port or
service fields to identify particular services that may be associated
with that port number or protocol number. It is a general statement
StJohns, Ed. & Huston, Ed. Expires June 27, 2003 [Page 1]
Internet-Draft Service Identifier December 2002
regarding appropriate processing and use of service identifiers by
intermediate systems.
2. Service Identifiers
Although not necessarily by design, certain conventions have evolved
with respect to the IP protocol suite relative to the identification
of services within an IP traffic flow:
o Within the IP protocol suite, end point identifiers (e.g. TCP/
UDP/SCTP port numbers, IP protocol numbers) are designed to
identify services to end points. In particular, TCP, UDP or SCTP
(Stream Control Transmission Protocol) port numbers are intended
to identify the source service location and the destination
service entity to the destination end point.
o The IP [2] datagram header contains the source and destination
address of the datagram as well as an indication of the upper-
level protocol (ULP) carried within the datagram. If the ULP is
either TCP [3], UDP [1], or SCTP [8] the payload will contain both
source and destination port numbers which allows differentiation
between services (e.g. TELNET, HTTP) and between multiple
instances of the same service between the pair of hosts described
by the source and destination address.
o By convention, for at least TCP and UDP, certain port numbers are
used as rendezvous points and are considered "well known" on the
source or destination side of the communication. Such rendezvous
points are maintained in an IANA registry currently located at
[11]. Specific registries for protocol and port numbers are at
[12] and [13].
o Notwithstanding the "well-knownness" of any given port, port
numbers are only guaranteed to be meaningful to the end systems.
An intermediate system should generally not impute specific
meaning to any given port number, unless specifically indicated by
an end system (e.g. via the Resource Reservation Protocol (RSVP)
[4] ) or agreed to by convention among the end systems and one or
more specific intermediate systems (e.g. firewall traversal for
the IP Security Protocol (IPSEC) [5]).
o Some services make use of protocol interactions to dynamically
allocate service identifiers (i.e. port numbers) to specific
communications. One specific example of this is the Session
Initiation Protocol (SIP) [9].
o Various products deployed today take advantage of the fact that
some service identifiers are relatively stable (and well known) to
StJohns, Ed. & Huston, Ed. Expires June 27, 2003 [Page 2]
Internet-Draft Service Identifier December 2002
do various things (e.g. firewall filtering, QOS marking).
o Certain network operations, such as various forms of packet
encapsulation (e.g. tunnelling) and encryption, can occlude this
port number (or service identifier) while an IP packet is in
transit within the network. For example, both the IPSEC
Encapsulating Security Payload (ESP) [6] and Generic Routing
Encapsulation (GRE) [7] both provide means for tunneling an IP
datagram within another IP datagram. The service information
becomes obscured and, in some instances, encrypted.
o Cooperating end systems may elect to use arbitrarily selected port
numbers for any service. The port numbers used in such cases may
be statically defined, through coordinated configuration of the
cooperating end systems through use of a common application or
operating system, or by dynamic selection as an outcome of a
rendezvous protocol.
Intermediate system imposed service-based controls may block
legitimate uses by subscribers. For example, some service providers
are blocking port 25 (i.e. notionally SMTP) traffic for the stated
purpose of trying to prevent SPAM, but which can also block
legitimate email to the end user.
Attempts by intermediate systems to impose service-based controls on
communications against the perceived interests of the end parties to
the communication are often circumvented[10]. Services may be
tunneled within other services, proxied by a collaborating external
host (e.g. an anonymous redirector), or simply run over an alternate
port (e.g. port 8080 vs port 80 for HTTP).
For the purposes of this memo a "party to a communication" is either
the sender, receiver or an agent of the sender or receiver in the
path. If intermediate systems take actions on behalf of one or more
parties to the communication or affecting the communication, a good
rule of thumb is they should only take actions beneficial to or
approved by one or more of the parties, that are within the
operational parameters of the service-specific protocol or are
unlikely to lead to widespread evasion by the user community.
3. Ramifications
The IAB observes that having stable and globally meaningful service
identifiers visible at points other than the end systems can be
useful for the purposes of determining network behavior and network
loading on a macro level. The IAB also observes that application
protocols that include dynamic port negotiation for both ends of a
connection tend to add to the complexity of the applications.
StJohns, Ed. & Huston, Ed. Expires June 27, 2003 [Page 3]
Internet-Draft Service Identifier December 2002
Dynamic port negotiation for a protocol may also limit or prohibit
its use in situations where the service provider (e.g. ISP or
employer) has instituted some form of service filtering through port
blocking mechanisms.
From this perspective of network and application utility, it is
preferable that no action or activity be undertaken by any agency,
carrier, service provider or organization which would tend to cause
end-users and protocol designers to generally obscure service
identification information from the IP packet header. Nothing in
this statement should be construed as opposing encapsulation or other
processes beneficial or specifically desired by the end-users.
4. Security Considerations
This document is a general statement regarding appropriate processing
and use of service identifiers by intermediate systems. If enough
agencies, carriers, service providers and organizations ignore the
concerns voiced here, the utility of port and protocol number for
service and firewall filtering on behalf of the end user might be
adversely affected.
Informative References
[1] Postel, J., "User Datagram Protocol", STD 6, RFC 768, August
1980.
[2] Postel, J., "Internet Protocol", STD 5, RFC 791, September
1981.
[3] Postel, J., "Transmission Control Protocol", STD 7, RFC 793,
September 1981.
[4] Braden, B., Zhang, L., Berson, S., Herzog, S. and S. Jamin,
"Resource ReSerVation Protocol (RSVP) -- Version 1 Functional
Specification", RFC 2205, September 1997.
[5] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.
[6] Kent, S. and R. Atkinson, "IP Encapsulating Security Payload
(ESP)", RFC 2406, November 1998.
[7] Farinacci, D., Li, T., Hanks, S., Meyer, D. and P. Traina,
"Generic Routing Encapsulation (GRE)", RFC 2784, March 2000.
[8] Stewart, R., Xie, Q., Morneault, K., Sharp, C., Schwarzbauer,
H., Taylor, T., Rytina, I., Kalla, M., Zhang, L. and V. Paxson,
StJohns, Ed. & Huston, Ed. Expires June 27, 2003 [Page 4]
Internet-Draft Service Identifier December 2002
"Stream Control Transmission Protocol", RFC 2960, October 2000.
[9] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
Peterson, J., Sparks, R., Handley, M. and E. Schooler, "SIP:
Session Initiation Protocol", RFC 3261, June 2002.
[10] New York Times, "STUDENTS EVADE UNIVERSITY TACTICS TO PROTECT
MEDIA FILES", November 27th 2002.
[11] <http://www.iana.org/numbers.html>
[12] <http://www.iana.org/assignments/protocol-numbers>
[13] <http://www.iana.org/assignments/port-numbers>
Authors' Addresses
Internet Architecture Board
EMail: iab@ietf.org
Appendix A. IAB Members
Internet Architecture Board Members at the time this document was
completed:
Harald Alvestrand
Ran Atkinson
Rob Austein
Fred Baker
Leslie Daigle, Chair
Sally Floyd
Ted Hardie
Geoff Huston
Charlie Kauffman
James Kempf
Eric Rescorla
Michael StJohns
StJohns, Ed. & Huston, Ed. Expires June 27, 2003 [Page 5]
Internet-Draft Service Identifier December 2002
Full Copyright Statement
Copyright (C) The Internet Society (2002). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
StJohns, Ed. & Huston, Ed. Expires June 27, 2003 [Page 6]
