EPHEMERAL PORT HOW TO
EPHEMERAL PORT WINDOWS

TCP requires that the 4-tuple of source IP address, source port number, destination IP address, and destination port number be unique for each TCP connection on the host. When a port range is exhausted, applications are unable to obtain a port for inter process connections and will fail.Įach TCP connection, inter-host or intra-host, is from a source TCP port number to a destination TCP port number. Operating systems have a fixed number of TCP ports, a subset of which are in the ephemeral port range.

The impact should be almost exclusive to the master server, but a media server supporting many hundreds of concurrent jobs might also be affected to some extent.Ĭaution: Starting a thousand or more restore job streams simultaneously also has the potential to exhaust the ephemeral port range on a NetBackup 8.1+ master server if the media servers are also at NetBackup 8.1+. The increased number of concurrent connections will reduce the amount of memory available for other processing and may slow the performance of applications. Further, each TCP end-point also consumes non-swapable kernel memory for the TCP Send and Receive queues.

EPHEMERAL PORT WINDOWS

Sites that have many or all backup windows configured to open simultaneously may find that their platforms and NetBackup now have the capacity to saturate the ephemeral port window, which can lead to connection and job failures. Sites that spread their backup and duplication windows throughout the night/weekend/day are unlikely to see any effect, other than jobs going from Queued to Active more quickly (until the concurrent per policy/client/storage limits are reached). This will allow jobs to go active more quickly, and will increase the concurrent connection and port usage in the seconds and minutes immediately following when a backup window opens. Note: NetBackup 8.2+ also no longer limits the startup of backup jobs to 1 job per second. NetBackup 8.2 removed the need for some connections and shortened the lifespan of others. NetBackup 8.2 roughly halved the ephemeral port use added by secure communication connections.

NetBackup 8.1 significantly increased ephemeral port use when introducing secure communication connections. NetBackup 7.1 minimized service port use by allowing many legacy services to accept connections via PBX. NetBackup 4.5 minimized ephemeral port use by deprecating legacy call-back. However, certain new features and functionality have also expanded the number of ports potentially in concurrent use. NetBackup has made design and implementation changes over the years to minimize the number of ports needed for concurrent operation. Computing hosts have become bigger, faster, and more interconnected (memory, CPU, network interfaces, I/O devices, etc.), but the limitations of TCP port availability have remained largely unchanged for decades. The goal is to allow NetBackup to perform as many operations as possible, as quickly as possible, without conflict. Otherwise applications may receive the wrong data, that was intended for a previous process, and either fail or behave in an unexpected fashion.

EPHEMERAL PORT HOW TO

Second, how to ensure that recently used TCP ports can be safely reused by other processes.

When the range is exhausted applications must fail, although many - NetBackup included - will retry briefly in hopes one does become available quickly. , how to ensure that as many TCP ports as possible are available for application use. To make these changes permanent as these definitions will vanish on every reboot you need to put a script in /etc/nfĪdd # Controls Ephemeral Port Range (this is for the admin to remember what it is) These will both change the port, chech this with # cat /proc/sys/net/ipv4/ip_local_port_range To change the port range you have two optionĮdit with nano or vi /proc/sys/net/ipv4/ip_local_port_range Know select the port range that you wan, I will define a port range of my desire but this is up to the network admin. With this modified port range you can open your firewall to ports that do not have any use but PASV FTP.įirst find out what the defined port range is # cat /proc/sys/net/ipv4/ip_local_port_range Rather than openning ports that need higher security for FTP we will change the port range. So security is an issue because leaving those original ports open leads to major security holes. We we all know that some of these ports are used for other more importand applications than FTP. The standart linux distrubition calls that the ephemeral port range be between 10.

Ephemeral port