Ephemeral port : What is it and what does it do?

Question

I suddenly came across the term "ephemeral port" in a Linux article that I was reading, but the author did not mention what it is.

What is an ephemeral port in UNIX?

Answer 1

In essence an ephemeral port is a random high port used to communicate with a known server port. For example, if I ssh from my machine to a server the connection would look like:

192.168.1.102:37852 ---> 192.168.1.105:22

22 is the standard SSH port I'm connecting to on the remote machine; 37852 is the ephemeral port used on my local machine

Answer 2

Today, generally:

Ports with numbers 0-1023 are called system or well-known ports; ports with numbers 1024-49151 are called user or registered ports, and ports with numbers 49152-65535 are called dynamic, private or ephemeral ports.
Registered port numbers are currently assigned by the... IANA... and were assigned by... ICANN... before March 21, 2001, and were assigned by the... USC/ISI... before 1998.

Source: https://en.wikipedia.org/wiki/Registered_port [modified]

...well-known ports or system ports. They are used by system processes that provide widely used types of network services. On Unix-like operating systems, a process must execute with superuser privileges to be able to bind a network socket to an IP address using one of the well-known ports.

Source: https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

Just as well-known and registered port numbers are used for server processes, ephemeral port numbers are for client processes only.

Source: https://books.google.si/books?id=Pm4RgYV2w4YC&pg=PA705

Without such ephemeral/temporary ports assigned, there might be Internet Protocol (IP)/network communication conflicts or downtimes. For example, there are two web servers and both listen on port 80. How would both server communicate? Would you implement some kind of "half-duplex" communication on the single 80 port (listen, transmit, listen, transmit...)? In such case, the communication would be at least slower. Not to mention that other clients would have to wait for the server's responses to other clients since its 80 port is temporarily unavailable (used to send response to a client)

Here come temporary ports which in this case would allow servers to keep listening on port 80 and communicate on other simultaneously (some kind of "full-duplex") For example, let's assume these are TCP/IP ports:

In client-server processes that use... TCP/IP... or... UDP..., the client initiates communication with a server through one of the many well-known ports. However, because the server does not initialize communication, it should not use a well-known port to send replies to the client, just in case a server-type application is running on that client device. Instead, the server to the client uses a new, temporarily assigned port that the client provides as the source port.
After communication is terminated, the port becomes available for use in another session. However, it is usually reused only after the entire port range is used up.
Different... OS... use different port ranges for ephemeral ports. Many Linux versions use port range 32768-61000, while Windows versions (until XP) use 1025-5000, by default. Later Windows versions, including Vista, Windows 7 and Server 2008, use the... IANA... suggested range of 49152-65535.

Source: https://www.techopedia.com/definition/19157/ephemeral-port

It's worth to mention the TCP self-connect issue in case of misconfiguration.

while true
do
     telnet 127.0.0.1 50000
done  

...
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
Trying 127.0.0.1...
Connected to 127.0.0.1.
...
What happened? In short, client connected to itself... It is interesting to note that Linux chooses ephemeral ports sequentially, not randomly...
The scenario of self connect described in this post is quite specific and requires specific preconditions. First, obviously, you need to (ab)use ephemeral ports for listening servers so that you clients try to connect to ephemeral ports.

Source: http://sgros.blogspot.com/2013/08/tcp-client-self-connect.html

Related:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/default-dynamic-port-range-tcpip-chang (The default dynamic port range for TCP/IP has changed since Windows Vista and...)
https://en.wikipedia.org/wiki/Duplex_(telecommunications)
https://jazzy.id.au/2012/08/23/why_does_chrome_consider_some_ports_unsafe.html
https://chromium.googlesource.com/chromium/src.git/+/refs/heads/master/net/base/port_util.cc (The general list of blocked ports...)

Answer 3

Ports 49152-65535 are known as ephemeral ports. Another name for it is private ports. It's called so because this range of ports can't be registered with IANA. When a client needs to communicate with a server, the client is assigned an ephemeral port on the other hand server listens on a registered port, which ranges from 1024 to 49151.

Answer 4

Quoting from Wikipedia:

An ephemeral port is a short-lived transport protocol port for Internet Protocol (IP) communications allocated automatically from a predefined range by the TCP/IP software. It is used by the Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or the Stream Control Transmission Protocol (SCTP) as the port assignment for the client end of a client–server communication to a well known port on a server.

The best example I know is FTP. And it's not a Unix-bound concept.