Client/Server ports: eventing mode & port 23404?

Solved318 viewsadl2099 eventing port range
1
2 Comments

Hi Dojo,
Sharing this trace from a WS capture: is it known why the DMA attempts to use port 23404?
By default, shouldn't this be in the dynamic range [49152;65535]?


I've hidden IP addresses, but it's DMA as source & CUBE client as destination.
The trace is captured on the NIC of the client running CUBE, when connecting to the DMA.

DM release 10.3.0.0-13184-CU5
Thanks

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 27th September 2024
Marieke Goethals [SLC] [DevOps Catalyst] commented

Hi Alberto,
Do you still need help with this question? If not, could you select the answer to indicate that the question is resolved?
Marieke Goethals [SLC] [DevOps Catalyst] commented

As this question has now been inactive for a long time, I will close it. If you still want more information, could you post a new question?

1 Answer

3
4.42K 1 Comment

Hi Alberto,

From this screenshot alone there is no conclusion that traffic on ports 23404 <-> 64398 is related to DataMiner traffic. Is this a phenomenon that you can reliably reproduce? If so, can you capture the entire lifespan of that TCP connection (I would expect to see atleast one preceding SYN connection handshake attempt) and/or find out to which processes those TCP ports belong on either end?

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 27th September 2024
Alberto De Luca [DevOps Enabler] commented

Thanks Bert, will double check the full capture for the SYN, I should be able to reproduce this again. Anything else I can do to identify the process?

The reason why I’m led to think it’s DataMiner traffic is that the capture was done on the NIC of the client, by filtering on the DMA IP address as destination: as such, no row was displayed in WS until I launched CUBE towards the DMA IP.

The additional thing noticed during the test was that the client connection falls back to “polling” mode when this port is not allowed on the local Windows firewall of the client (the restriction wasn’t explicit though, was just “all port allowed” VS “allow only the eventing dynamic port range”).