1

I'm getting ready to start networking at my local college and I can't wait to ask a bunch of questions, many of which have been answered on here thankfully. But I have one that is left unanswered: What are the possible security flaws of Port Triggering? I'm still wrapping my head around it, but is this description accurate?

Local machine "1" is sending data through (out of) a general port for a service (e.g. IRC) to the internet. This port is now occupied with outgoing traffic and cannot intake external traffic? Thus it tells the router to forward (open) a port for that same external service to return data to local machine "1".


My "flow chart":

Local Machine1 192.168.0.5:6667 --> LAN --> Router --> ISP --> IRC Server --> ISP --> Router --> Local Machine1:6668

Note if anyone could improve this wikipedia page (add citations) the human race would greatly appreciate you for it. It would also be a good idea to add some of the following tags: port-triggering Let me know if you do eh, cheers.

2 Answers 2

1

To give you some background, when your host is behind a firewall in a private network and you wish to be reachable by external network (internet), you need to use concepts like port forwarding or port triggering.

Routers which allow port triggering, some ports are configured to be used for triggering purpose. These ports can be opened only by internal private IP and not by any external host. If any external host scans these ports they are seen as closed. Moreover these ports are opened only for the time internal IP is listening to it and packets are flowing through it. After an idle time (timeout) the router itself closes it. Also ports are not binded to any internal IP so any internal host can trigger these ports.

Looking at the way port triggering works, it seems rather more secure than its counter part port forwarding which maps a port to an IP and keeps it open for any traffic coming to that port from external host indefinitely.

The only concern is whether the service listening on your host machine can differentiate between unintended traffic coming via that port or not.

1
  • "Moreover these ports are opened only for the time internal IP is listening to it and packets are flowing through it. After an idle time (timeout) the router itself closes it. Also ports are not binded to any internal IP so any internal host can trigger these ports." This is exactly what I was looking for thank you so much!
    – Tmanok
    Aug 31, 2017 at 22:58
0

The "port" you are apparently talking about is a logical port (potentially) connected to another port somewhere else (also called a socket). There are 65535 ports for each logical address (for TCP and UDP each), so you're not easily running out of them.

Port triggering is something different (in respect to the logical ports) that might or might not solve problems related to network address translation. It's not an easy topic for beginners.

The physical interface on a network card, switch, router, ... is also called a "port". Since it is multiplexed by a multitude of network layers, protocols and logical addresses and ports, it can provide practically unlimited logical connections at any given time.

Theoretically, a single gigabit Ethernet interface can receive and send data from/to more than a million different endpoints in every second.

1
  • " The "port" you are apparently talking about is a logical port (potentially) connected to another port somewhere else (also called a socket). There are 65535 ports for each logical address (for TCP and UDP each), so you're not easily running out of them. " Thanks that's really good to know! Makes more sense now :)
    – Tmanok
    Aug 31, 2017 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.