Understanding, and viewing, how ports are allocated by ssh tunnels?

Question

I was trying to figure out a small problem with connecting to vnc through an SSH tunnel today where one of the possible issues was that someone else was already tunneled to the port. Without going into the specifics of that problem, it made me realize I'm not as knowledgeable at how to ssh tunnels are allocating resources and how to view them.

So I have two questions. First, if I create an SSH tunnel but am not currently using that tunnel (ie, nothing on my local system has connected to the tunneled port) which ports are currently blocked and unavailable for others to use? I'm pretty sure my source port will be owned by my tunnel and thus not be available to be bound by another application, but what about the destination port? Is that port already bound to the tunnel or does it only get bound when I try to connect to my local port and the connection is tunneled through SSH to my destination port?

Secondly, how can I view what ssh tunnels exist on my system? If I created the tunnel locally I can do a ps and grep for the appropriate program, but if I have a client creating a local tunnel to my server's port is there a way that, from my server, I can see that this tunnel exists; even if the client has not yet connected to a program through the tunnel?

Answer 1

netstat and lsof or fuser are typical programs to view what ports are opened by what (though may require root or such access, depending, and vary by flavour of unix). A shared destination port is fine. It may help to work through e.g. Beej's guide to networking to understand the system calls involved.

If the client has not connected, then any ports it tunnels are not bound, as that step will only happen as a connection is made. (Exception: there may be ports lingering from a now closed connection in TIME_WAIT or such.)

Answer 2

On a Linux client, you may view listening ports with netstat -lnp |less.

Within an ssh session, you can press enter twice, then type ~#. That will list the currently forwarded ports for that session.

Answer 3

There are Tunnels and Port fowardings. You are talking about the second of them. Just not to confuse terms, ok?

(1) For Local port forwarding the forwarded combination host:port on local computer is blocked (accepts connections). On the other side remote_host:remote_port is available for different connections. The data are send after you start the connection from local end.

For Remote port forwarding it is the other way round.

(2) As other proposed in other answers, you can use netstat to see local listening ports and when using multiplexed connection / from inside connection, there is ~#, which prints active sessions and TCP forwardings.