Port numbers
A filter can also match a packet’s port number attributes, but only if the filter’s protocol type is set to TCP or UDP, since only those protocols use port numbers. The filter can be configured to match the following:
•The source port number (the port on the sending host that originated the packet)
•The destination port number (the port on the receiving host that the packet is destined for)
By matching on a port number, a filter can be applied to selected TCP or UDP services, such as Telnet, FTP, and World Wide Web. The following tables show a few common ser- vices and their associated port numbers:
Internet service | TCP port | Internet service | TCP port |
|
|
|
|
|
|
|
|
FTP | 20/21 | Finger | 79 |
|
|
|
|
Telnet | 23 | World Wide Web | 80 |
|
|
|
|
SMTP (mail) | 25 | News | 144 |
|
|
|
|
Gopher | 70 | rlogin | 513 |
|
|
|
|
|
|
|
|
Internet service | UDP port | Internet service | UDP port |
|
|
|
|
|
|
|
|
Who Is | 43 | TFTP | 69 |
|
|
|
|
World Wide Web | 80 | who | 513 |
|
|
|
|
SNMP | 161 |
|
|
|
|
|
|
Port number comparisons
A filter can also use a comparison option to evaluate a packet’s source or destination port number. The comparison options are:
•No Compare: No comparison of the port number specified in the filter with the packet’s port number.
•Not Equal To: For the filter to match, the packet’s port number cannot equal the port number specified in the filter.
