RFC 3639

RFC 3639 🎀

Considerations on the use of a Service Identifier in Packet Headers ✨

• RFC number: 3639
• Working group: Network Working Group
• Authors: M. St. Johns, Ed. and G. Huston, Ed. (IAB)
• Category: Informational
• Date: October 2003
• Obsoletes / Updates: the title block doesn't list any RFCs it obsoletes or updates 📝

---

Status of this Memo 📝

This memo gives information to the Internet community 💅 It does not specify an Internet standard of any kind. Distribution of this memo is unlimited 🌈

Copyright Notice ©️

Copyright (C) The Internet Society (2003). All Rights Reserved. 💜

Abstract 🦋

okay so this memo is all about some things to think about when you use IP protocol number fields and payload protocol (e.g., TCP) port fields to identify particular services. those fields can be linked to a specific port number or protocol number, and that's the whole vibe 🧚

1. Introduction ✨

okay so this memo covers some things to consider when you use IP protocol number fields and payload protocol (e.g., TCP) port or service fields to identify particular services that might be tied to that port number or protocol number. it's basically a general statement on how intermediate systems should process and use service identifiers 💖

this memo points out that when intermediate systems try to filter or block traffic based on the service identification inside the traffic flow, it has a limited effect 🙈 it also has a major side effect: affected services get forced to redesign themselves with encapsulation or dynamic port negotiation, just to get that fixed service identification out of the IP packet headers 💀 the IAB doesn't think that's good for the wider Internet community when it comes to building simple and reliable Internet applications 😭 so this memo suggests that people think about control mechanisms that don't rely on intermediary systems acting on an assumed relationship between the service identifier in the packet and the actual service the packet belongs to 🫶

2. Service Identifiers 🌸

not on purpose, but certain conventions have grown up around the IP protocol suite for identifying services inside an IP traffic flow. it's giving organic growth 🌿

• Within the IP protocol suite, end point identifiers (e.g., TCP/UDP/SCTP port numbers, IP protocol numbers) are designed to identify services to end points. In particular, TCP, UDP or SCTP (Stream Control Transmission Protocol) port numbers are intended to identify the source service location and the destination service entity to the destination end point. 🎀
• The IP [2] datagram header contains the source and destination address of the datagram as well as an indication of the upper-level protocol (ULP) carried within the datagram. If the ULP is either TCP [3], UDP [1], or SCTP [8] the payload will contain both source and destination port numbers, which allows differentiation between services (e.g., TELNET, HTTP) and between multiple instances of the same service between the pair of hosts described by the source and destination address. 🧠
• By convention, for at least TCP and UDP, certain port numbers are used as rendezvous points and are considered "well known" on the source or destination side of the communication. Such rendezvous points are maintained in an IANA registry currently located at [11]. Specific registries for protocol and port numbers are at [12] and [13]. 📚
• Notwithstanding the "well knownness" of any given port, port numbers are only guaranteed to be meaningful to the end systems. An intermediate system should generally not impute specific meaning to any given port number, unless specifically indicated by an end system (e.g., via the Resource Reservation Protocol (RSVP) [4]) or agreed to by convention among the end systems and one or more specific intermediate systems (e.g., firewall traversal for the IP Security Protocol (IPSEC) [5]). 🙅‍♀️
• Some services use protocol interactions to dynamically allocate service identifiers (i.e., port numbers) to specific communications. One specific example of this is the Session Initiation Protocol (SIP) [9]. The implication is that intermediate systems can't relate the service identifiers to the actual service unless they take part in the protocols that allocate the service identifiers, or they're explicitly told the outcome of the allocation. 🦋
• Various products and service-related mechanisms deployed today take advantage of the fact that some service identifiers are relatively stable (and well known) to do various things (e.g., firewall filtering, QOS marking). 🔥
• Certain network operations, such as various forms of packet encapsulation (e.g., tunneling) and encryption, can occlude this port number (or service identifier) while an IP packet is in transit within the network. For example, both the IPSEC Encapsulating Security Payload (ESP) [6] and Generic Routing Encapsulation (GRE) [7] provide means for tunneling an IP datagram within another IP datagram. The service information becomes obscured and, in some instances, encrypted. 🔐
• Cooperating end systems may elect to use arbitrarily selected port numbers for any service. The port numbers used in such cases may be statically defined, through coordinated configuration of the cooperating end systems through use of a common application or operating system, or by dynamic selection as an outcome of a rendezvous protocol. 🍓

Intermediate system imposed service-based controls may block legitimate uses by subscribers 😤 For example, some service providers are blocking port 25 (i.e., notionally SMTP) traffic for the stated purpose of trying to prevent SPAM, but that can also block legitimate email to the end user 📧💀

Attempts by intermediate systems to impose service-based controls on communications against the perceived interests of the end parties to the communication are often circumvented [10] 🏃‍♀️💨 Services may be tunneled within other services, proxied by a collaborating external host (e.g., an anonymous redirector), or simply run over an alternate port (e.g., port 8080 vs port 80 for HTTP). Another way around it is changing the service behavior to use a dynamic port negotiation phase, so it avoids using a constant port address 🙃

For the purposes of this memo, a "party to a communication" is either the sender, the receiver, or an authorized agent of the sender or receiver in the path 🫶

If intermediate systems take actions on behalf of one or more parties to the communication, or that affect the communication, a good rule of thumb is that they should only take actions that are beneficial to or approved by one or more of the parties. Those actions should also stay within the operational parameters of the service-specific protocol, or otherwise be unlikely to lead to widespread evasion by the user community 👑✨

Intellectual Property Statement 💅

The IETF doesn't take a side on whether any intellectual property rights claimed over this technology are valid or how far they reach, and it doesn't promise it went hunting for those rights either 🙈 If you want the IETF's procedures for rights in standards-track and standards-related documents, check out BCP-11. Claims of rights that were filed for publication, any licence assurances, and the results of attempts to get a general licence or permission from the IETF Secretariat are all available there too ✨

The IETF also invites anyone who knows about copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to practise this standard to tell them about it. Send that info to the IETF Executive Director 🫶

Appendix A. IAB Members 👑

These were the Internet Architecture Board members when this document was finished 🧚

• Bernard Aboba
• Harald Alvestrand
• Rob Austein
• Leslie Daigle, Chair
• Patrik Faltstrom
• Sally Floyd
• Jun-ichiro Itojun Hagino
• Mark Handley
• Geoff Huston
• Charlie Kaufman
• James Kempf
• Eric Rescorla
• Michael St Johns

Editors' Addresses 💖

Mike St Johns Internet Architecture Board

EMail: mstjohns@mindspring.com

Geoff Huston Internet Architecture Board

EMail: gih@telstra.net

Full Copyright Statement 🎀

Copyright (C) The Internet Society (2003). All Rights Reserved. 🌸

You can copy this document and share it with others, and you can make derivative works that comment on it, explain it, or help people implement it. Those works can be written, copied, published, and distributed, in whole or in part, with no real restrictions, as long as the copyright notice and this paragraph are on every copy and derivative work 🦋 The one catch is that the document itself can't be changed in any way. That means you can't remove the copyright notice or the references to the Internet Society or other Internet organisations. There are two exceptions: you can change it when needed to develop Internet standards, in which case the Internet Standards process copyright procedures must be followed, or you can change it to translate it into languages other than English 🌈

These permissions are permanent and won't be revoked by the Internet Society or its successors or assignees ⭐

The document and the information in it are provided "AS IS", and the Internet Society and the Internet Engineering Task Force say no to all warranties, express or implied. That includes any warranty that using the information won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose 💀 Here's the exact wording:

THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🍓

Funding for the RFC Editor function is currently provided by the Internet Society ✨