LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 06-24-2014, 05:14 AM   #1
dvadell
LQ Newbie
 
Registered: Aug 2010
Posts: 6

Rep: Reputation: 0
ping using port 1025


Hi everyone!

Does anyone knows why ping is connecting to port 1025?

I was troubleshooting a dns problem, and made an strace of ping to an unexisting address. It happens that before sending the ICMP packet, only once, it makes this strange... connection? (it's UDP so it's not a connection)

07:13:13 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
07:13:13 connect(4, {sa_family=AF_INET, sin_port=htons(1025) sin_addr=inet_addr("10.200.200.144")}, 16) = 0
07:13:13 getsockname(4, {sa_family=AF_INET, sin_port=htons(57372), sin_addr=inet_addr("10.200.200.1")}, [16]) = 0
07:13:13 close(4)

(10.200.200.144 is the unexisting host, and 10.200.200.1 is from where I'm running ping)

I googled it, and found hints that it's used in DNS, or NFS (see wikipedia for example). I do have both: the DNS server I'm using and a NFS client, but I'm not running ping in an NFS-mounted directory.

Any hint? I'm really curious about this.

Cheers,
-- Diego.
 
Old 06-24-2014, 05:29 AM   #2
Doc CPU
Senior Member
 
Registered: Jun 2011
Location: Stuttgart, Germany
Distribution: Mint, Debian, Gentoo, Win 2k/XP
Posts: 1,099

Rep: Reputation: 344Reputation: 344Reputation: 344Reputation: 344
Hi there,

Quote:
Originally Posted by dvadell View Post
Does anyone knows why ping is connecting to port 1025?
in fact, the ping utility does issue a DNS lookup (or reverse lookup) on the hostname or IP that you sepcify. I'm just surprised about the port number, because DNS uses UDP port 53, AFAIK, not 1025.

[X] Doc CPU
 
Old 06-24-2014, 07:30 AM   #3
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,816

Rep: Reputation: 7307Reputation: 7307Reputation: 7307Reputation: 7307Reputation: 7307Reputation: 7307Reputation: 7307Reputation: 7307Reputation: 7307Reputation: 7307Reputation: 7307
probably this helps: https://secure.dslreports.com/forum/...open-in-linux-
 
Old 06-25-2014, 12:19 AM   #4
dvadell
LQ Newbie
 
Registered: Aug 2010
Posts: 6

Original Poster
Rep: Reputation: 0
Hi,
Well, I went to the source, iptutils from http://www.skbuff.net/iputils/ . It looks like it uses (hardcoded) port 1025 as source port to send it's dns requests:

Quote:
dst.sin_port = htons(1025);
if (nroute)
dst.sin_addr.s_addr = route[0];
if (connect(probe_fd, (struct sockaddr*)&dst, sizeof(dst)) == -1) {
if (errno == EACCES) {
But I can't figure why it was sending dns requests to the unexisting host instead of the DNS server, or anything else. I can't even see in ping.c where it does the dns resolution. I suck at C :-/

Thanks for your answers!
-- Diego.
 
Old 01-11-2016, 04:55 AM   #5
NevemTeve
Senior Member
 
Registered: Oct 2011
Location: Budapest
Distribution: Debian/GNU/Linux, AIX
Posts: 4,860
Blog Entries: 1

Rep: Reputation: 1869Reputation: 1869Reputation: 1869Reputation: 1869Reputation: 1869Reputation: 1869Reputation: 1869Reputation: 1869Reputation: 1869Reputation: 1869Reputation: 1869
I'd like to get an answer for this, too.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Ping from port A to port B on same NIC allooshy Linux - Networking 7 12-02-2009 10:51 AM
1025-1026-1027 ... Udp gabsik Linux - Security 2 07-10-2006 07:53 PM
Redhat fresh install port 1025 eyewittness Linux - Security 4 02-18-2005 11:23 AM
Repeated, targeted port 1025 ACK RST scottman Linux - Security 2 10-06-2004 01:35 AM
Port 1025 and 53 UDP being hammered with Blackjack dholingw Linux - Security 2 06-11-2004 02:02 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:47 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration