0

This might be a really stupid question, but something I really want to understand.

My understanding is a tcp connections staying open indicates that each of the network devices between the client and server is actively assigning a ephemeral port for the connection so that the response can reach the client correctly.

So when a websocket connection is opened, it should mean that the same tcp connection is staying open as long as the socket is up and all the network devices in between the client and server are actually keeping one of its ephemeral open just to serve one client?

In such cases isn't it probable for the network devices to run out of ephemeral ports?

What am I missing here? Can anyone please guide me so that I can try to get a better understanding of the underlying process here?

  • "My understanding is a tcp connections staying open indicates that each of the network devices between the client and server is actively assigning a ephemeral port for the connection so that the response can reach the client correctly." No. Routers do not know or care about the transport protocols. Each network packet is routed independently of any other, and the path the next one in a flow takes could be different, and it does not matter because they reach the destination. – Ron Maupin Jul 6 at 15:21
2

A TCP connection is characterized by 4 parameters : source and destination port, but also source and destination IP address (both v4 or both v6). Therefore, you can have 64K connections between any two devices, and this does not hinder either side in its connections with a third host.

Network devices between the client and server usually work on IP level, and don't care about TCP ports. The big exception is NAT (Network Address Translation), a hack to share a single IPv4 address between client devices. In this case the 64K connections to a single server are shared between those clients.

| improve this answer | |
  • you can have 64K connections between any two devices - in theory. I don't know of any stack implementation that allows sharing the same source port between sockets or even applications. – Zac67 Jul 6 at 11:06
  • @Zac67: Windows allows it, Linux has some restrictions AFAIK. – MSalters Jul 6 at 11:28
  • Linux can do it as well. Check out the article I linked in my answer. – Jeff Wheeler Jul 7 at 13:16
2

a tcp connections staying open indicates that each of the network devices between the client and server is actively assigning a ephemeral port for the connection so that the response can reach the client correctly.

Not quite. An ephemeral port is used on the client side only (a normal user-level application cannot allocate anything else but an ephemeral port). The server uses its known port for all sessions (e.g. 443 for HTTPS). Intermediate routers forward the IP packet (L3) solely by destination IP, regardless of its payload, L4 protocol, etc.

In case of source NAT, the private-to-public NAT router allocates a public source port on its WAN interface (single public IP address or address pool) which could theoretically be shared with other NAT sessions connecting elsewhere.

A destination NAT router on the server side (public-to-private) doesn't require a port on its LAN interface. It simply replaces the destination IP and L4 port according to its forwarding table.

Basically, the socket ties up an ephemeral port only on the client and, if applicable, on a source NAT router.

| improve this answer | |
1

Ephemeral port exhaustion is a real problem for some load-balancer / proxy configurations where a large number of TCP connections are made between the same two peers / IP addresses.

NGINX has a good article about how to recognize the problem in logs and information about a way to mitigate it. The article is Linux-specific but the concepts discussed are general to TCP.

If you have this concern in your environment, you might get a better discussion in the superuser forum. However, you might look into keep-alive possibilities, or opening more TCP ports on your websocket server and distributing connections across them, to mitigate any ephemeral port constraints you run into.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.