Poco's POP Port [Mod: moved]

[nonmirecordo]

I've just checked my port-mapper (Vision - free from here) and I've noticed that Poco is mapped to port 3270.

Is there any reason why 110 isn't used?

[robin]

Port 110 is the port on the server, not the client. As I understand it the client can use any port it wants to.

I was using an IP Message logger and getting some strange port numbers as the messages bounced around beteen Barca and my AV (KAV) and then on to the server.

[nonmirecordo]

Hi Robin

Thanks for the quick response.

Port 110 is the port on the server

If you're right (and I'm not doubting you) then I've some homework to do! I've always assumed it was the client port. I don't know why I assumed that

[Eric]

If you're right (and I'm not doubting you) then I've some homework to do! I've always assumed it was the client port. I don't know why I assumed that

See also this picture.



Too late, Robin beat me again.

[robin]

This is a little off-topic, so I'm moving the thread to the e-mail hall, but the other thing to bear in mind is that source port numbers are used by NAT routers and can therefore change as the packet pops out onto the internet.

NAT (Network Address Translation) is used by routers where you have more than one computer on the "user" side of the router but only one address on the "internet" side of the router.

If one of my computers sends a request to the internet (say my POP3 server) it creates a request with the destination IP address and port number (110) and the source IP address (me) and port number. The source IP address is my computer's address on my network (say) 192.168.1.3. However this address is not a valid address on the internet, only on my network [*], so the router takes the 192.168.1.3 off and puts its own address on (194.247.44.171) and then sends the request to the server still addressed to port 110.

The server puts together the reply and sends it back to the IP address and port that was in the original request.

How does the router know which of the computers on my network to return the reply to? That's where the port number comes in. When the router has taken the source IP address off and added its own before sending the request on its way, it changes the source port number too. When the reply comes back, the router looks at the port number, compares that to its record of ones that it has changed and then replaces the IP address and port with that of the computer that originally made the request and sends the reply back to that computer on the local network.

OK, there is more information there than most people would like to know, but it demonstrates that the source port can be almost any, only the destination port is fixed (110 for POP3, 25 for SMTP, 80 or 8080 for HTTP and 21 for FTP are just some examples).

[*] This address is one of a series of addresses that are reserved for use on private networks and as a result will never appear on the intenet. They are:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255

Too late, Robin beat me again.

[nonmirecordo]

the source port can be almost any, only the destination port is fixed

Thanks for the explanation which has made things much clearer.



Well it did, until just now when I kicked off the process mapper (with PM running) and now PM doesn't show at all! Now I'm confused again. Maybe this is good example of a little knowledge being a dangerous thing. Everything is working fine, email comes and goes, NOD32 intercepts every incoming email as it should - no problem.

I shouldn't be so inquisitive.

[robin]

The port probably won't be seen until you connect - check mail or something and see what happens. When I check with Barca, my firewall shows the ports being created and lost dynamically (I use Agnitum Outpost).

[nonmirecordo]

No luck with the port mapper - I think the timing was pure luck the first time!

However, it was plain to see using my firewall's packet log - 110 is the source port and (this time) 4309 the client's. It looks like PM uses a random selection each time you connect, but YMMV.

Thanks for the input, guys, (fortunately) you learn something new every day.

William

[robin]

(Vision - free from here)

Where? I thought I'd take a look but can't see it.

[nonmirecordo]

I thought you might struggle - click on 'download' over on the left, then on 'free tools' on the new menu.

Lots of goodies there.