Why doesn't Linux use the IANA Ephemeral port range?

Question

According to Wikipedia

The Internet Assigned Numbers Authority (IANA) suggests the range 49152 to 65535 for dynamic or private ports. Many Linux kernels use the port range 32768 to 61000.

Even though there seems to be some historical deviation from IANA's suggested range, it seems awkward that Windows Vista, Windows 7, Windows Server 2008, FreeBSD 4.6+ and many others all have agreed upon this range and yet Linux still stands out.

Looking into it though, lo and behold:

$ cat /proc/sys/net/ipv4/ip_local_port_range 
32768   61000

Why hasn't Linux adopted the standard range?

Solution

There was a time when IANA only assigned ports up to 1023. See RFC1700. At one time this was a standard. Most of the time I have no trouble finding when things change in the stream of RFC's but for the question of changing ports from 1024 to 49152 from registered to assigned I came up short.

In terms of Linux history, there was a question raised about the default ip_local_port_range in 2007. At that time it was decided to use the Linux range you mention for fear that high port numbers might cause problems and beginning the range at 49152 might leave too few port numbers in the pool. See this and its thread. The expressed thought at the time was that beginning at 32768 was within the spirit of the IANA's procedures, if not fully conformant. In reading this I infer that the developers assumed most assignments would occur from the bottom of the range and move up. At this writing I count a little more than 100 port numbers assigned (not counting different protocols as separate) between 32768 and 49152, so that has held up pretty well over the last five years.

I don't know why the range was considered too small, but I can imagine two reasons:

1. Port numbers are randomized to thwart certain attacks. The more addresses in the pool, the better this defense can work.
2. High activity servers might have trouble with port number exhaustion. While ports might be ephemeral, their use is not instantaneous. In particular sockets can last several minutes after TCP close.

This blog post touches on number 2, and suggests an answer should you wish your Linux systems to use a different range of local ports. (Using /etc/sysctl.d to define a range you like. There is also a ip_local_reserved_ports entry that may be of use if a particular conflict arrises. These match up with the /proc/sys entry you quote.)

In summary. The Linux defaults don't match the current IANA specifications, but any particular Linux system can, if its owner desires.

Comments

[Brandon Condrey]

Here is the thread about Linux uses ports near IANA ceiling

[jmb]

@evan RFC 6056 goes on to say that "port numbers that may be needed for providing a particular service at the local host SHOULD NOT be included in the pool of port numbers available for ephemeral port randomization" and that "administrators should identify services that may be offered by the local host and SHOULD exclude only the corresponding registered ports" but that's not something that the OS typically provides for you to do. The only practical exclusion mechanism is to raise the lower bound.