RFC6056(7)

🌸 RFC6056(7) — the rfc6056 girlies' guide to port randomization 🌸

okay so this is RFC6056 from the Miscellaneous Information Manual section (that's section 7, bestie, we're in misc territory) and it's literally all about port randomization algorithms. buckle up 💅

---

✨ NAME ✨

rfc6056 — port randomization algorithms 🎀

---

🦋 DESCRIPTION 🦋

so the rfc6056 algorithms exist to randomize the port allocation of outgoing UDP packets, and the whole point is protection from a series of "blind" attacks — y'know, the kind where the attacker's entire flex is guessing the sequence of ephemeral ports tied to your outgoing packets. not on our watch, fr fr. for more deets, consult RFC 6056.

the individual algorithms are described below 👇

🍓 The RFC 6056 algorithms 🍓

the following algorithms are available:

• bsd — this is the default NetBSD port selection algorithm, and the way it works is it starts from anonportmax and proceeds decreasingly through the available ephemeral ports. iconic, lowkey predictable-but-default behavior 💖
• random_start — selects ports randomly from the available ephemeral ports. if a collision with a local port is detected, the algorithm proceeds decreasingly through the sequence of ephemeral ports until a free port is found. ⚠️ note: the random port selection algorithms are not guaranteed to find a free port — yeah, that's a real caveat, don't @ me 😭
• random_pick — selects ports randomly from the available ephemeral ports. if a collision with a local port is detected, the algorithm tries selecting a new port randomly until a free port is found. keep trying bestie energy ✨
• hash — selects ports using a md5(3) hash of the local address, the foreign address, and the foreign port. ⚠️ note that in the case of a bind(2) call some of this information might be unavailable, and the port selection is delayed until the time of a connect(2) call, performed either explicitly or up calling sendto(2). so it's fashionably late 💅
• doublehash — selects ports using a md5(3) hash of the local address, foreign address, and foreign port coupled with a md5(3) hash of the same components obtained using a separate table that is associated with a subset of all outgoing connections. the same considerations regarding late connection as in the case of hash apply. double the hash, double the vibe 🔥
• randinc — use random increments in order to select the next port. short, sweet, random 🎲

---

🌈 SYSCTL CONTROLS 🌈

the following sysctl controls are available for selecting the default port randomization algorithm:

• net.inet.ip.anonportalgo.available — type: string, changeable: no
• net.inet.ip.anonportalgo.selected — type: string, changeable: yes
• net.inet6.ip6.anonportalgo.available — type: string, changeable: no
• net.inet6.ip6.anonportalgo.selected — type: string, changeable: yes

(yes bestie, that's inet and inet6, and yes, available is read-only — selected is the one you get to touch 👑)

---

🧚 SOCKET OPTIONS 🧚

the IP_PORTSEL socket option at the IPPROTO_IP level and the IPV6_PORTSEL socket option at the IPPROTO_IPV6 level can be used with a string argument specifying the algorithm's name in order to select the port randomization algorithm for a specific socket. per-socket glow-up, we love to see it 🫶

for more info see setsockopt(2).

---

💜 SEE ALSO 💜

setsockopt(2), sysctl(3), sysctl(7)

---

⭐ HISTORY ⭐

the rfc6056 algorithms first appeared in NetBSD 6.0. vintage ✨

---

ngl if you got this far you're officially a port randomization main character. go forth and scramble those ephemeral ports 🌸

---

and that's a wrap on the Debian build of this page, dated August 25, 2011 — yeah she's an elder but she still slays 😌💖