Considerations on the use of a Service Identifier in Packet Headers
Understanding how networks identify services in traffic
Johns, M. St., Ed., Huston, G., Ed., and IAB, "Considerations on the use of a Service Identifier in Packet Headers", RFC 3639, DOI 10.17487/RFC3639, October 2003, <https://www.rfc-editor.org/info/rfc3639>.
@misc{rfc3639,
series = {Request for Comments},
number = 3639,
howpublished = {RFC 3639},
publisher = {RFC Editor},
doi = {10.17487/RFC3639},
url = {https://www.rfc-editor.org/info/rfc3639},
author = {M. St. Johns and G. Huston and IAB},
title = {{Considerations on the use of a Service Identifier in Packet Headers}},
pagetotal = 8,
year = 2003,
month = oct,
} RFC text
Contents
Network Working Group M. St. Johns, Ed.
Request for Comments: 3639 G. Huston, Ed.
Category: Informational IAB
October 2003
Considerations on the use of a
Service Identifier in Packet Headers
Status of this Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract
This memo describes some considerations relating to the use of IP
protocol number fields and payload protocol (e.g., TCP) port fields
to identify particular services that may be associated with that port
number or protocol number.
1. Introduction
This memo describes some considerations relating to the use of IP
protocol number fields and payload protocol (e.g., TCP) port or
service fields to identify particular services that may be associated
with that port number or protocol number. It is a general statement
regarding appropriate processing and use of service identifiers by
intermediate systems.
This memo points out that various measures by intermediate systems
that are intended to filter or prevent the transmission of traffic
based on the service identification within the traffic flow will have
a limited effect. This will also have a major side-effect of
forcing the affected services to be redesigned using various forms of
encapsulation or dynamic port negotiation in order to remove the
fixed service identification from the IP packet headers. The IAB
does not believe this serves the general interests of the Internet
community related to the design of simple and reliable Internet
applications. This memo suggests some thought be given to control
mechanisms that do not rely on intermediary systems taking actions
based on an assumed relationship between the service identifier in
the packet and the actual service of which the packet is a part.
2. Service Identifiers
Although not necessarily by design, certain conventions have evolved
with respect to the IP protocol suite relative to the identification
of services within an IP traffic flow:
o Within the IP protocol suite, end point identifiers (e.g.,
TCP/UDP/SCTP port numbers, IP protocol numbers) are designed to
identify services to end points. In particular, TCP, UDP or SCTP
(Stream Control Transmission Protocol) port numbers are intended
to identify the source service location and the destination
service entity to the destination end point.
o The IP [2] datagram header contains the source and destination
address of the datagram as well as an indication of the upper-
level protocol (ULP) carried within the datagram. If the ULP is
either TCP [3], UDP [1], or SCTP [8] the payload will contain both
source and destination port numbers which allows differentiation
between services (e.g., TELNET, HTTP) and between multiple
instances of the same service between the pair of hosts described
by the source and destination address.
o By convention, for at least TCP and UDP, certain port numbers are
used as rendezvous points and are considered "well known" on the
source or destination side of the communication. Such rendezvous
points are maintained in an IANA registry currently located at
[11]. Specific registries for protocol and port numbers are at
[12] and [13].
o Notwithstanding the "well knownness" of any given port, port
numbers are only guaranteed to be meaningful to the end systems.
An intermediate system should generally not impute specific
meaning to any given port number, unless specifically indicated by
an end system (e.g., via the Resource Reservation Protocol (RSVP)
[4]) or agreed to by convention among the end systems and one or
more specific intermediate systems (e.g., firewall traversal for
the IP Security Protocol (IPSEC) [5]).
o Some services make use of protocol interactions to dynamically
allocate service identifiers (i.e., port numbers) to specific
communications. One specific example of this is the Session
Initiation Protocol (SIP) [9]. The implication of this is that
intermediate systems cannot relate the service identifiers to the
actual service unless they participate in the protocols which
allocate the service identifiers, or are explicitly notified of
the outcome of the allocation.
o Various products and service-related mechanisms deployed today
take advantage of the fact that some service identifiers are
relatively stable (and well known) to do various things (e.g.,
firewall filtering, QOS marking).
o Certain network operations, such as various forms of packet
encapsulation (e.g., tunneling) and encryption, can occlude this
port number (or service identifier) while an IP packet is in
transit within the network. For example, both the IPSEC
Encapsulating Security Payload (ESP) [6] and Generic Routing
Encapsulation (GRE) [7] both provide means for tunneling an IP
datagram within another IP datagram. The service information
becomes obscured and, in some instances, encrypted.
o Cooperating end systems may elect to use arbitrarily selected port
numbers for any service. The port numbers used in such cases may
be statically defined, through coordinated configuration of the
cooperating end systems through use of a common application or
operating system, or by dynamic selection as an outcome of a
rendezvous protocol.
Intermediate system imposed service-based controls may block
legitimate uses by subscribers. For example, some service providers
are blocking port 25 (i.e., notionally SMTP) traffic for the stated
purpose of trying to prevent SPAM, but which can also block
legitimate email to the end user.
Attempts by intermediate systems to impose service-based controls on
communications against the perceived interests of the end parties to
the communication are often circumvented [10]. Services may be
tunneled within other services, proxied by a collaborating external
host (e.g., an anonymous redirector), or simply run over an alternate
port (e.g., port 8080 vs port 80 for HTTP). Another means of
circumvention is alteration of the service behavior to use a dynamic
port negotiation phase, in order to avoid use of a constant port
address.
For the purposes of this memo, a "party to a communication" is either
the sender, receiver, or an authorized agent of the sender or
receiver in the path.
If intermediate systems take actions on behalf of one or more parties
to the communication or affecting the communication, a good rule of
thumb is they should only take actions that are beneficial to or
approved by one or more of the parties, within the operational
parameters of the service-specific protocol, or otherwise unlikely to
lead to widespread evasion by the user community.
3. Ramifications
The IAB observes that having stable and globally meaningful service
identifiers visible at points other than the end systems can be
useful for the purposes of determining network behavior and network
loading on a macro level. The IAB also observes that application
protocols that include dynamic port negotiation for both ends of a
connection tend to add to the complexity of the applications.
Dynamic port negotiation for a protocol may also limit or prohibit
its use in situations where the service provider (e.g., ISP or
employer) has instituted some form of service filtering through port
blocking mechanisms.
From this perspective of network and application utility, it is
preferable that no action or activity be undertaken by any agency,
carrier, service provider, or organization which would cause end-
users and protocol designers to generally obscure service
identification information from the IP packet header.
Nothing in this statement should be construed as opposing
encapsulation, application security, end-to-end encryption, or other
processes beneficial or specifically desired by the end-users.
4. Security Considerations
This document is a general statement regarding appropriate processing
and use of service identifiers by intermediate systems. If enough
agencies, carriers, service providers, and organizations ignore the
concerns voiced here, the utility of port and protocol numbers,
general network analysis, end-user beneficial filtering (e.g.,
preventing DDOS attacks), and other common uses of these service
identifiers might be adversely affected.
5. References
[1] Postel, J., "User Datagram Protocol", STD 6, RFC 768, August
1980.
[2] Postel, J., "Internet Protocol", STD 5, RFC 791, September
1981.
[3] Postel, J., "Transmission Control Protocol", STD 7, RFC 793,
September 1981.
[4] Braden, B., Ed., Zhang, L., Berson, S., Herzog, S. and S.
Jamin, "Resource ReSerVation Protocol (RSVP) -- Version 1
Functional Specification", RFC 2205, September 1997.
[5] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.
[6] Kent, S. and R. Atkinson, "IP Encapsulating Security Payload
(ESP)", RFC 2406, November 1998.
[7] Farinacci, D., Li, T., Hanks, S., Meyer, D. and P. Traina,
"Generic Routing Encapsulation (GRE)", RFC 2784, March 2000.
[8] Stewart, R., Xie, Q., Morneault, K., Sharp, C., Schwarzbauer,
H., Taylor, T., Rytina, I., Kalla, M., Zhang, L. and V. Paxson,
"Stream Control Transmission Protocol", RFC 2960, October 2000.
[9] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
Peterson, J., Sparks, R., Handley, M. and E. Schooler, "SIP:
Session Initiation Protocol", RFC 3261, June 2002.
[10] New York Times, "STUDENTS EVADE UNIVERSITY TACTICS TO PROTECT
MEDIA FILES", 27th November 2002.
[11] IANA, "IANA Protocol Numbers and Assignment Services", May
2003, <http://www.iana.org/numbers.htm>.
[12] IANA, "IANA Protocol Number Registry", May 2003, <http://
www.iana.org/assignments/protocol-numbers>.
[13] IANA, "IANA Port Number Registry", May 2003, <http://
www.iana.org/assignments/port-numbers>.
Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the
IETF's procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. Copies of
claims of rights made available for publication and any assurances of
licenses to be made available, or the result of an attempt made to
obtain a general license or permission for the use of such
proprietary rights by implementors or users of this specification can
be obtained from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive
Director.
Appendix A. IAB Members
Internet Architecture Board Members at the time this document was
completed were:
Bernard Aboba
Harald Alvestrand
Rob Austein
Leslie Daigle, Chair
Patrik Faltstrom
Sally Floyd
Jun-ichiro Itojun Hagino
Mark Handley
Geoff Huston
Charlie Kaufman
James Kempf
Eric Rescorla
Michael St Johns
Editors' Addresses
Mike St Johns
Internet Architecture Board
EMail: mstjohns@mindspring.com
Geoff Huston
Internet Architecture Board
EMail: gih@telstra.net
Full Copyright Statement
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assignees.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
AI ELI5
On this page
§1Introduction
RFC 3639 is an informational document from the Internet Architecture Board that examines how service identification works in the Internet Protocol (IP) suite. It focuses on the relationship between IP protocol numbers and port numbers (which identify services like email or web traffic) and how intermediate systems—such as firewalls, routers, and network management systems—use these identifiers to make decisions about which traffic to allow or block.
The document addresses a practical tension in network design: while knowing which service a packet carries is useful for network operators, intermediate systems that block traffic based on service identifiers often encourage application developers to hide or change these identifiers to avoid filtering. This drives protocol redesign in ways that may not serve the broader Internet community.
Different messages get different postal codes. Networks look at these codes to decide what to do with traffic. This note talks about whether that is a good idea.
§2How Services Are Identified
The IP protocol suite uses several mechanisms to identify which service a packet is carrying. At the IP layer, a protocol number field indicates whether the packet contains TCP, UDP, or another upper-level protocol. When the upper-level protocol is TCP or UDP, each packet includes source and destination port numbers. These port numbers serve as identifiers: well-known ports like 25 for SMTP (email) or 80 for HTTP (web traffic) are registered with IANA and recognized worldwide.
However, the RFC emphasizes an important principle: port numbers are designed to be meaningful to end systems only. Intermediate systems in the path (routers, firewalls) should not assume that a packet using port 80 is actually web traffic, as end systems can negotiate different port numbers for their own purposes. Some protocols like the Session Initiation Protocol (SIP) dynamically allocate port numbers during communication, making it impossible for intermediate systems to know the service without participating in the protocol itself.
End systems may also choose arbitrary port numbers by configuration or agreement, and many services use non-standard ports. For example, a web server might run on port 8080 instead of 80.
Computers put a number in each message saying which service it is for. But those numbers are just hints for the receiving computer—the actual service might be different if the computers agreed to that.
§3Service Filtering and Its Consequences
Many network operators deploy filtering based on service identifiers: firewalls block port 25 (SMTP) to prevent spam, for example. The RFC points out that while this is motivated by legitimate concerns, the consequences are problematic. Services can be circumvented through several methods: tunneling one protocol inside another, proxying traffic through a collaborative external server, running on alternate ports, or implementing dynamic port negotiation to avoid using a constant port address.
The result is that service-based controls impose a cost on the network community. Rather than accepting filtering, services redesign themselves—sometimes in more complex ways—to evade it. Port 25 blocking, intended to reduce spam, also blocks legitimate outgoing email for users and forces email clients to use alternate mechanisms.
The RFC suggests that intermediate systems should only take actions on service identifiers when these actions align with the interests of the parties to the communication or are specifically agreed upon (as with RSVP resource reservation or firewall rules configured for a specific enterprise).
If a mail carrier refuses to deliver mail to certain addresses, people find new ways to send letters instead of just accepting it. The blocking creates more work, not less.
§4Trade-offs for Network Designers
The RFC observes a fundamental tension in network design. Stable and visible service identifiers are useful: they allow network operators to understand traffic patterns, determine network loading, and implement helpful filtering (such as blocking DDoS attacks). However, stable identifiers also make it easy to block services, which encourages application designers to add complexity in the form of dynamic port negotiation or encryption that obscures the service.
The IAB's position is that the general interests of the Internet community are better served by transparency in service identification, and that control mechanisms should not rely on intermediate systems taking actions based on assumed relationships between port numbers and actual services. This does not oppose encryption for security or privacy, only the pressure that comes from blocking based on service identifiers.
Networks work better when everyone can see what type of message is being sent. But if networks block based on what they see, services get designed to hide it.