Subject: [tsvwg] FW: [IANA #800143] Port squatting

From: "Bellingar, Richard J. (RET-DAY)" <[email-masked]>
Date: Sun, 11 Jan 2015 17:01:13 +0000

I really don't understand Pearl's answer (below). At one time, I found a means (an email address, I think) to report companies/applications that were using ports in the System & Registered ranges that were not reserved or were reserved by other companies/apps. Those then, presumably, were added to the IANA database and depicted in the "Known Unauthorized Uses" column of http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml . Has that practice ceased?

-----Original Message-----
From: Pearl Liang via RT [mailto:[email-masked]] 
Sent: Wednesday, January 07, 2015 12:03 PM
To: Bellingar, Richard J. (RET-DAY)
Subject: [IANA #800143] Port squatting

Hello,

Thank you for contacting us.

On Sat Dec 20 04:05:46 2014, [email-masked] wrote:
> Is there still a means to report port squatting? I found one in the 
> past, but can't find one now.
> 

First of all, we do not monitor any traffic flowing to or from any and all port numbers, specifically unassigned port numbers (0-49151.)  Nor do we have knowledge of traffic to any port numbers 0-49151.  We sought some advices from the IESG designated port expert who indicated that we (IETF) are not regulating the port traffic.

You may contact the IETF Transport Area Working Group at [email-masked] if you prefer.  

Thank you,

Pearl Liang
ICANN

---

From: "Eggert, Lars" <[email-masked]>
Date: Mon, 12 Jan 2015 11:15:42 +0000

Hi,

> I really don't understand Pearl's answer (below). At one time, I found a means (an email address, I think) to report companies/applications that were using ports in the System & Registered ranges t…

no, but it involves the IETF and the area director. So raising it on this list is the right thing to do, and then Martin and Spencer can instruct IANA via the IESG as needed.

Lars

---

From: "Bellingar, Richard J. (RET-DAY)" <[email-masked]>
Date: Mon, 12 Jan 2015 13:48:21 +0000

Lars,
	Thanks for the response.
	A recent firewall change request in support of a Progress database installation that I challenged surfaced the following -

"Each remote server is assigned a port when it is initially spawned. By default, the remote servers use the first available port in the 1025-2000 range on UNIX (3000-5000 for Windows)."
http://knowledgebase.progress.com/articles/Article/P98541

	The article does also give instructions for assigning an "alternate" port range.

Rick Bellingar
Reed-Elsevier Information Security
937-865-7005

-----Original Message-----
From: Eggert, Lars [mailto:[email-masked]] 
Sent: Monday, January 12, 2015 6:16 AM
To: Bellingar, Richard J. (RET-DAY)
Cc: [email-masked]; [email-masked]
Subject: Re: [tsvwg] [IANA #800143] Port squatting

Hi,

Lars

---

From: Joe Touch <[email-masked]>
Date: Fri, 16 Jan 2015 10:54:28 -0800

Hi, Richard, et al.,

IANA currently indicates when a port is being squatted to help advise
applicants for new assignments, so they can decide for themselves
whether they want to deal with that.

But if IANA were to indicate the specific squatter, that could be taken
as endorsement of squatting. That's problematic - especially for
assigned ports.

I.e., if this was reporting squatting, that should still be supported by
IANA IMO (and I think it is, though the form to do so might need to be
restored). However, I don't think IANA should post the details of that
other than "Known unauthorized use".

Joe