Do ports randomise deliberately for security reasons?

Yashy used Ask the Experts™
Hi guys

As part of the last question I asked about firewall rules, I am looking at our firewall right now and monitoring the traffic. I'm looking at the traffic between VPN connections from our stores to a main server. These stores are all using the same application to communicate with the server. However, I'm looking at the server and it is receiving connections from our various stores, but every single store is communicating via a different port. So one store will be coming through port 4274. The other one will send it via port 4288. My point is, are applications specifically written in this way to prevent security breaches from happening by constantly randomising their port sequences so that they can't be 'guessed' by a malicious attacker?

And if that is the case, surely going back to the answers being given previously, this does warrant the ability for the 'ANY' ports to be open from site A to site B via VPN.

Thank you
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
It is a security measure. "Prevent" is too strong of a word in any security discussion. But it implemented as a possible deterrent, yes. Which is why. As I said in that previous question, restricting ports via registry is actually LESS secure even though it let's you make more refined firewall rules.

Security theatre.

And as I blatantly stated at the beginning of that question, yes the randomized nature does "warrant" (though I'd prefer the word "justify") the use of "any" rules on site-to-site VPN tunnels.

So these answers were in your last question actually. But hopefully this clarifies.
Are you referring to source ports or destination ports?

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial