This article provides information about identifying which port is defined as junos-ymsg .
junos-ymsg
Here, junos-ymsg is set with TCP/5050 :
root@s3> show configuration groups junos-defaults applications application junos-ymsg term t1 protocol tcp destination-port 5000-5010; <<<<<<<< term t2 protocol tcp destination-port 5050; term t3 protocol udp destination-port 5000-5010; term t4 protocol udp destination-port 5050;
Nevertheless, TCP/5000 is identified as junos-ymsg . How to identify which ports are included by junos-ymsg ?
root@s3> show security flow session session-identifier 2049 Session ID: 2049, Status: Normal Flag: 0x40 Policy name: t2u/4 Source NAT pool: Null, Application: junos-ymsg/33 Dynamic application: junos:UNKNOWN, Maximum timeout: 1800, Current timeout: 1782 Session State: Valid Start time: 82705, Duration: 18 In: 8.8.8.1/2732 --> 7.7.7.8/5000;tcp, Interface: fe-0/0/1.0, Session token: 0x8, Flag: 0x21 Route: 0x120010, Gateway: 8.8.8.1, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 0, Pkts: 1, Bytes: 40 Out: 7.7.7.8/5000 --> 8.8.8.1/2732;tcp, Interface: fe-0/0/7.0, Session token: 0x6, Flag: 0x20 Route: 0x90010, Gateway: 7.7.7.8, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 0, Pkts: 0, Bytes: 0 Total sessions: 1
Obtain the service type:
root@s3> request pfe execute target fwdd command "show usp app-def tcp" ... GOT: tcp port=5050, appl_name=junos-ymsg, service type=33, alg id=0, timeout=1800 ...
Obtain the ports with the service type:
root@s3> request pfe execute target fwdd command "show usp app-def alg-id 33" SENT: Ukern command: show usp app-def alg-id 33 GOT: GOT: (R) ALG vector: 0x0 GOT: (R) TCP list GOT: 5000-5010 GOT: 5050 GOT: (R) UDP list GOT: 5000-5010 GOT: 5050 GOT: (W) ALG vector: 0x0 LOCAL: End of file
How does SRX know that TCP/5000-5010 is junos-ymsg ? It is hardcoded as:
application low high protocol timeout index ----------- ----- ----- -------- ------- ----- "aim", 5190, 5194, TCP, 1800, 1 "aim", 5190, 5190, UDP, 60, 2 "chargen", 19, 19, TCP, 1800, 1 "chargen", 19, 19, UDP, 60, 2 "dhcp", 67, 68, UDP, 60, 0 "discard", 9, 9, TCP, 1800, 1 "discard", 9, 9, UDP, 60, 2 "dns", 53, 53, TCP, 1800, 1 "dns", 53, 53, UDP, 60, 2 "echo", 3785, 3785, TCP, 1800, 1 "echo", 3785, 3785, UDP, 60, 2 "finger", 79, 79, TCP, 1800, 0 "ftp", 21, 21, TCP, 1800, 0 "gopher", 70, 70, TCP, 1800, 0 "gprs-gtp-c", 2123, 2123, TCP, 90, 1 "gprs-gtp-c", 2123, 2123, UDP, 90, 2 "gprs-gtp-u", 2152, 2152, TCP, 90, 1 "gprs-gtp-u", 2152, 2152, UDP, 90, 2 "gprs-gtp-v0", 3386, 3386, TCP, 90, 1 "gprs-gtp-v0", 3386, 3386, UDP, 90, 2 "gprs-sctp", 0, 0, SCTP, 1800, 0 "http", 80, 80, TCP, 300, 0 "https", 443, 443, TCP, 1800, 1 "https", 443, 443, UDP, 60, 2 "ident", 113, 113, TCP, 1800, 0 "ike", 500, 500, UDP, 60, 0 "ike", 4500, 4500, UDP, 60, 0 "ike-esp-nat", -1, -1, UDP, 60, 0 "imap", 143, 143, TCP, 1800, 1 "imap", 143, 143, UDP, 60, 2 "irc", 194, 194, TCP, 1800, 0 "ldap", 389, 389, TCP, 1800, 0 "lpr", 515, 515, TCP, 1800, 0 "mgcp-ca", 2727, 2727, UDP, 7200, 0 "mgcp-ua", 2427, 2427, UDP, 7200, 0 "ms-rpc", 135, 135, TCP, 60, 1 "ms-rpc", 135, 135, UDP, 60, 2 "ms-sql", 1433, 1433, TCP, 1800, 0 "msn", 1863, 1863, TCP, 1800, 0 "nas", 991, 991, TCP, 1800, 1 "nas", 991, 991, UDP, 60, 2 "nbds", 138, 138, TCP, 1800, 1 "nbds", 138, 138, UDP, 60, 2 "nbname", 137, 137, UDP, 60, 0 "nfs", 2049, 2049, UDP, 2400, 0 "nntp", 119, 119, TCP, 1800, 0 "ntp", 123, 123, UDP, 60, 0 "nutella", 6346, 6347, TCP, 1800, 1 "nutella", 6346, 6347, UDP, 60, 2 "pop3", 110, 110, TCP, 1800, 0 "pptp", 1723, 1723, TCP, 1800, 1 "pptp", 1723, 1723, UDP, 60, 2 "q931", 1720, 1720, TCP, 1800, 0 "radius", 1812, 1813, UDP, 60, 0 "ras", 1719, 1719, UDP, 60, 0 "realaudio", 7070, 7070, TCP, 1800, 0 "rexec", 512, 512, TCP, 1800, 0 "rlogin", 513, 513, TCP, 1800, 0 "rsh", 514, 514, TCP, 1800, 0 "rtsp", 554, 554, TCP, 1800, 0 "sccp", 2000, 2000, TCP, 1800, 0 "sip", 5060, 5060, TCP, 1800, 1 "sip", 5060, 5060, UDP, 60, 2 "smb", 445, 445, TCP, 1800, 1 "smb", 139, 139, TCP, 1800, 2 "smtp", 25, 25, TCP, 1800, 0 "snmp", 161, 161, TCP, 1800, 1 "snmp", 161, 161, UDP, 60, 2 "snmptrap", 162, 162, TCP, 1800, 1 "snmptrap", 162, 162, UDP, 60, 2 "sqlmon", 1434, 1434, UDP, 60, 0 "sqlnet-v2", 1521, 1521, TCP, 1800, 0 "ssh", 22, 22, TCP, 1800, 1 "ssh", 22, 22, UDP, 60, 2 "sun-rpc", 111, 111, TCP, 2400, 1 "sun-rpc", 111, 111, UDP, 2400, 2 "syslog", 514, 514, UDP, 60, 0 "talk", 517, 518, TCP, 1800, 1 "talk", 517, 518, UDP, 60, 2 "telnet", 23, 23, TCP, 1800, 0 "tftp", 69, 69, UDP, 60, 0 "vdo", 7000, 7010, TCP, 1800, 0 "vnc", 5800, 5800, TCP, 1800, 1 "vnc", 5900, 5900, TCP, 1800, 2 "whois", 43, 43, TCP, 1800, 0 "winframe", 1494, 1494, TCP, 1800, 0 "xing", 1558, 1558, UDP, 60, 0 "ymsg", 5000, 5010, TCP, 1800, 1 "ymsg", 5000, 5010, UDP, 60, 2 "ymsg", 5050, 5050, TCP, 1800, 3 "ymsg", 5050, 5050, UDP, 60, 4
2020/07/27: Article reviewed for accuracy; minor changes made; article valid