6

Why is the BGP foreign address port 1027?

I use BGP to connect Router1 and Router2, but when I show the TCP progress:

Router1>show tcp brief 
TCB       Local Address           Foreign Address        (state)
4E976890  10.0.0.1.179           10.0.0.2.1027         ESTABLISHED

We say the BGP is based on TCP port 179. Why is Router2's BGP on port 1027?

Improve this question

3 Answers 3

Reset to default
9

One side of the connection will have an arbitrary port number, the other will be on 179.

Cisco Press "BGP Fundamentals" has a good explanation (link)

the neighbor with the higher IP address manages the connection. The router initiating the request uses a dynamic source port, but the destination port is always 179.

Example 1-1 shows an established BGP session using the command show tcp brief to display the active TCP sessions between routers. Notice that the TCP source port is 179 and the destination port is 59884 on R1, and the ports are opposite on R2.

Example 1-1: Established BGP session

RP/0/0/CPU0:R1# show tcp brief | exc "LISTEN|CLOSED"
   PCB     VRF-ID     Recv-Q Send-Q Local Address    Foreign Address      State
0x088bcbb8 0x60000000      0      0  10.1.12.1:179    10.1.12.2:59884     ESTAB

R2# show tcp brief
TCB       Local Address               Foreign Address             (state)
EF153B88  10.1.12.2. 59884            10.1.12.1.179               ESTAB

This is just the same as any other TCP connection: the passive open side sits and waits on a well-known port number; the active open side uses an arbitary port. This makes it much easier to manage many-to-many TCP links.

Improve this answer
3
  • What's the correct way to protect these random ports in iptables?
    – bswinnerton
    Commented Dec 1, 2018 at 16:57
  • Question is about Cisco routers, what are you wanting to protect with iptables?
    – jonathanjo
    Commented Dec 1, 2018 at 17:39
  • @bswinnerton - most likely you will only filter on connection-initiating traffic (--dport 179) and let the connection tracking mechanism handle the responses (--state ESTABLISHED, for example?)
    – Bogd
    Commented Dec 9, 2018 at 13:29
5

TCP source vs. destination ports.

To give a different example: HTTP servers listen on TCP port 80. So when you are connecting to a web server, you will automatically use TCP/80 as the destination port. However, the source port is a random one above 1024.

The exact same thing happens with BGP - the client (the router initiating the connection) will connect to TCP destination port 179. But the source port for that connection will be a random high port.

Improve this answer
2

In general, the BGP use TCP 179 port as the BGP service. the client connect BGP service port there is no limit.

such as the SSH server use 22 as its port, there is no limit for the client port.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.