Re: NSX-T log source port

frozenbanana · ‎11-06-2023

Hi
When I checked vRealize Log Insight, I found that some logs have the same source ports and some logs have different source ports each other.
What's the difference between these following cases?

--------------------------------------------------------------------------------------

2023. 11. 6. 10:15:9.659 FIREWALL-PKTLOG: INET match PASS 9642 OUT 52 TCP 00.00.43.72/5614->00.00.145.11/343 S
2023. 11. 6. 10:15:9.106 FIREWALL-PKTLOG: INET match PASS 9642 OUT 52 TCP 00.00.43.72/5614->00.00.145.11/343 S
2023. 11. 6. 10:15:8.602 FIREWALL-PKTLOG: INET match PASS 9642 OUT 52 TCP 00.00.43.72/5614->00.00.145.11/343 S

2023. 11. 6. 10:15:42.055 FIREWALL-PKTLOG: INET TERM PASS 9642 OUT TCP RST 00.00.43.72/5616->00.00.145.11/343 1/1 52/40
2023. 11. 6. 10:15:33.077 FIREWALL-PKTLOG: INET TERM PASS 9642 OUT TCP RST 00.00.43.72/5615->00.00.145.11/343 1/1 52/40
2023. 11. 6. 10:15:32.065 FIREWALL-PKTLOG: INET TERM PASS 9642 OUT TCP RST 00.00.43.72/5614->00.00.145.11/343 1/1 52/40
2023. 11. 6. 10:15:32.065 FIREWALL-PKTLOG: INET TERM PASS 9642 OUT TCP RST 00.00.43.72/5613->00.00.145.11/343 1/1 52/40

EvertAM · ‎11-10-2023

The client is in charge of choosing it's TCP source port, either completely dynamically, like you'll see with a browser, or a fixed port (or pool of ports) for something like DHCP for example.

It appears that the client (the source in this logs) has setup multiple connections to the same host.
It's hard to tell if this is normal in this specific instance, tcp/343 is not an IANA assigned port and I personally don't really recognize it.