TCP port "rtps-dd-ut"? - tcp

When I use netstat I see that string instead of a port number. What is this? When I search for it I find a website from which it seems like it is the same as 7401. But I never heard about the fact that you can use strings instead of numbers for ports. I'm searching for detailed explanation of that topic but cannot find it.

Related

Can't connect to NAS, even via IP

Background
Been having a lot if issues with this problem. Randomly PC won't connect to NAS for apparently no reason at all, while others it works. I read tonne of posts about various fixes, some worked sometimes, some didn't, but lately none did. Restarting PC, NAS, or router didn't work, nor did changing settings, checking firewall, antivirus, etc.. Finally I managed to figure it out.
Our nas allow us to make a network name to access it by, like \\MyServer, but sometimes when power goes out, or we have to restart router, this address won't work because the server's local IP had changed, and the address was still cached on our computer to the old one.
The reason can be one of many. In my case, it was none that I could find common answers to.
TL;DR
I randomly can't connect to my NAS via \\MyServer or it's IP \\10.0.0.3, but other PC's can.
I suggest using Synology Assistant. This will find the NAS on the network if it is physically in range.
Then I highly recommend to use a fix IP address for the NAS. It is no good idea having servers with DHCP...
Reason (in my specific case)
Sometimes the PC would only connect to the NAS via IPv6 (almost feel like it does it on a whim), IPv4 won't work at all. That or the old IP is cached on your system.
IPv4 looks something like one of these: 10.0.0.5, 172.16.0.2, or 192.168.0.0
IPv6 looks something like: fe80::842a:a43d:3123:1332
Quick fix attempt first
First, just try opening command prompt and enter ipconfig /flushdns, then try to connect to your usual \\MyServer address, see if that works now.
Didn't work?
What you can try is to see if you can connect via its IPv6 — but first you need to somehow obtain it.
Step 1 In command prompt, type ping MyServer (replaced with whatever name you have), and it see if it manages to ping it. If it does, it will resolve the IP and show an IPv6. If it shows IPv4 or can't connect at all, see further down.
Step 2 Locate the IPv6 at the top, remove % and number after.
Step 3 Replace : with -. Note doubles if you have that: :: with --.
Step 4 Prefix the usual \\ at the start, and add .ipv6-literal.net at the end. Now try to connect to the server using that. With the IPv6 example above, it'd be something like: \\fe80--842a-a43d-3123-1332.ipv6-literal.net
Ping shows IPv4?
Try to ping with one of the other computers, or if you are able to, login to the web dashboard or equivalent on one of those computers, and see if you can find any information about the server's IP's, with goal of finding its IPv6.
Once found, do steps above.
Done!
Other stuff:
IPv6 in browser — remove the % and number, put IP inside brackets [] and then connect. Example: http://[fe80::842a:a43d:3123:1332].
Creating alias of the weird IPv6:
Step 1 Right click Notepad, and open as Administrator
Step 2 Go to File → Open, change the dropdown above 'open' from Textfiles (*.txt) to All files (*.*).
Step 3 Locate the hosts file, located at C:\C:\Windows\System32\drivers\etc\ and open
Step 4 At the bottom, write the IPv6 with the colons AND the %##, then a space, then the alias you want it to use (case insensitive). Example: fe80::842a:a43d:3123:1332%15 MyAlias and save. You should now be able to use \\MyAlias to connect to it.
NOTE The %## number is unique to each computer. E.g. your computer gets %15, the next get %7. The rest of the IP is identical. To get the %## number of a different PC, write ipconfig in its command prompt. It should list its own IPv6 with its appended %## at the end.
Another note: If you need to change an IP in the hosts file of an IP that no longer work, you also need to use ipconfig /flushdns again.

Difference in IP address formats

I asked a client to send me the ip address of all of their locations so that I could block them from analytics.
Most of them are what I know as normal: 0.00.000.000
but some of them are coming to be kind of like this: 2001:500:f000:100:7000:40d0:3000:400c
They are all going to google and typing "whats my ip address" and sending me the results. Is the second example an ip address I can exclude? do I need to convert it some how?
Those are IPv6 addresses. What you're looking at inside the usual xxx.xxx.xxx.xxx format is IPv4.
These two formats of addressing are entirely incompatible with one another. They cannot be "converted", however when dealing with application layer systems they should/usually work in almost the exact same way. i.e. if you were to ban an IPv6 address, it would work in the same way as banning an IPv4.
There's a plethora of documentation available online about IPv6, and it's probably a bit out of scope for this site, so I hope that helps you figure it all out! Even if it is just a single piece of your puzzle :)

Finding the correct "network interface" number for IPv6

I am trying to use Boost for some IPv6 and multicast network communication. I need to construct an IPv6 multicast socket that uses a specific network interface index.
I was able to find the correct multicast option to set the network interface index in boost/asio/ip/detail/socket_option.hpp:
explicit multicast_request(const boost::asio::ip::address_v6& multicast_address, unsigned long network_interface = 0)
The problem is, I don't know how to find the correct value for the "network_interface" parameter. Is there a way to get the network_interface value using a local IPv6 address that I can provide? I looked in the documentation and examples, but couldn't find anything.
-- Dylan
Each platform provides APIs to enumerate the network interfaces, e.g. getifaddrs for many Unixes and GetAdaptersAddresses for Windows. Note on Windows there is a separate numerical space for IPv4 and IPv6 adapters which makes the API call if_nametoindex quite confusing.
You may wish to inspect the methods I employed in OpenPGM for portability, considering Windows doesn't really have useful adapter names:
http://code.google.com/p/openpgm/source/browse/trunk/openpgm/pgm/getifaddrs.c
http://code.google.com/p/openpgm/source/browse/trunk/openpgm/pgm/nametoindex.c
http://code.google.com/p/openpgm/source/browse/trunk/openpgm/pgm/indextoaddr.c
http://code.google.com/p/openpgm/source/browse/trunk/openpgm/pgm/indextoname.c
I don't think there's a platform-independent way to figure this out, just as there is no portable solution to enumerating the local addresses.
On Linux, you can find what you want in the second column of /proc/net/if_inet6, which is also available more robustly through the rtnetlink(7) interface.

intercepting network data from a particular program

im looking for a way to detect, and capture data being sent TO and FROM a specific program, ive attempted to use something like wireshark but it all seems to be a bunch of nonsense to me, so i was wondering if anybody could help me get the data, translate it into text, to allow for editing, and then to resend the new edited information on its way.
Look for Capture TCP stream feature/menu item in Wireshark.
Edit: It's actually Follow TCP Stream.
Wireshark is definitely the way to go. It'll capture the data going to a specific port (which you can probably correlate to a the program fairly easily). I hope this isn't happening over SSL though (wireshark isn't going to help you much if it is).
But if you have to reverse engineer the server's communication protocol, capturing the network packets is the least of your problems. Reverse engineering is difficult and can be fairly error prone as it's often based on guess work. My suggestion is to do this as a last resort: if the server is intended to communicate with the outside world, there's probably some protocol documentation floating around somewhere that will be much more reliable than a wireshark trace.

How should one go about choosing a default TCP/IP port for a new service?

When developing an app that will listen on a TCP/IP port, how should one go about selecting a default port? Assume that this app will be installed on many computers, and that avoiding port conflicts is desired.
Go here and pick a port with the description Unassigned
First step: look at IANA listing :
There you will see at the tail of the list
"The Dynamic and/or Private Ports are those from 49152 through 65535"
so those would be your better bets, but once you pick one you could always google on it to see if there is a popular enough app that has already "claimed" it
If by widely-used, you mean you want to protect against other people using it in the future, you can apply to have it marked as reserved for your app by IANA here
The most comprehensive list of official IANA port numbers and non-official port numbers I know is nmap-services.
You probably want to avoid using any ports from this list (Wikipedia).
I would just pick one, and once the app is used by the masses, the port number will become recognized and included in such lists.
Choosing an unassigned one from the IANA list is usually sufficient, but if you are talking about a commercially-released product, you really should apply to the IANA to get one assigned to you. Note that the process of doing this is simple but slow; the last time I applied for one, it took a year.
As others mention, check IANA.
Then check your local systems /etc/services to see if there are some custom ports already in use.
And please, don't hardcode it. Make sure it's configurable, someway, somehow -- if for no other reason that you want to be able to have multiple developers using their own localized builds at the same time.
If this is for an application that you expect to be used widely, then register a number
here so no-one else uses it.
Otherwise, just pick an unused one randomly.
The problem with using one in the dynamic range is that it may not be available because it may be being used for a dynamic port number.
Well, you can reference some commonly used port numbers here and try not to use anyone else's.
If by "open to the public at large" you mean you're opening ports on your own systems, I'd have a chat with your system administrators about which ports they feel comfortable with doing that with.
Choose a number that is not very common
Choose a default port that doesn't interfere with the most common daemons and servers. Also make sure that the port number isn't listed as an attack vector for some virus -- some companies have strict policies where they block such ports no matter what. Last but not least, make sure the port number is configurable.
Use iana list. Download the csv file from :
https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
and use this shell script for searching for unregistred ports:
for port in {N..M}; do if ! grep -q $port service-names-port-numbers.csv; then echo $port;fi; done;
and put 2 numbers instead of N and M.

Resources