Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?

share|improve this question
1  
"I usually am not sure which one the application uses?" Then ask for help. Ask others "which protocols/ports do xxxx uses?" or rather, ask "how do I determine which protocols/ports xxxx uses?" You cannot properly configure a firewall if you have no idea which network protocols are used. –  curiousguy Nov 19 '11 at 15:53
1  
You are right, but that is why I'm asking, is worth knowing, does it make any difference. If it does I'll look into it. –  enedene Nov 19 '11 at 18:19
    
I am actually saying that a firewall hurts more than it helps when used by less-than-experts (it can cause a lot of confusion, and does not protect much, if at all). I know that this is not exactly the consensus in the security community. So I am actually suggesting to not enable the firewall in the first place. –  curiousguy Nov 19 '11 at 20:14
    
@curiousguy Windows Vista/7's firewall has actually come a long way in preventing the confusion you're talking about (unlike most/all third party firewalls, which block ^%&%ing everything), so I think think it's very true anymore that only someone with a Computer Science degree should have an active firewall. –  Ben Brocka Nov 20 '11 at 2:59
    
These days everyone should be running a firewall. Windows firewall is now very good out of the box, for a home user. @Gowenfawr's answer is good. –  Rory Alsop Nov 21 '11 at 0:03
add comment

1 Answer

up vote 3 down vote accepted

So, SSH needs port 22/tcp. You're asking if opening 22/tcp and 22/udp presents a security vulnerability. The answer is "no" if nothing is listening to 22/udp. If some other application is listening to 22/udp, an application which you wouldn't want open to other hosts, then it could. There are such combinations (syslog and rsh share 514, for example).

That being said, there's really not much excuse for not knowing which an application uses. On Linux, for example, you can use "netstat -tunlp" or "lsof -i" to see which program is listening to which port(s), and tune your firewall rules correctly.

share|improve this answer
    
Will do that, thank you. –  enedene Nov 19 '11 at 18:17
    
You don't have to have the software running to find its port. The very most ports are listed in /etc/services. –  freddyb Nov 20 '11 at 3:52
    
@freddyb good to know, thanks. –  enedene Nov 20 '11 at 10:22
1  
/etc/services lists expectations but not necessarily realities, especially for anything that isn't standard, low, and reasonably old. For example, squid is going to open several ports (56624/udp? huhwhat?) that services doesn't know anything about, and services thinks that squids actual proxy port (3128/tcp) is ndl-aas (the Active API Server Port, of course!) –  gowenfawr Nov 20 '11 at 16:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.