1

I'm trying to make my RMI service work across a Firewall. I followed instructions in this answer to run both RMI Registry and my RMI service on port 1099, yet, I'm seeing different port numbers being opened on RMI client and server when I do netstat.

[user@machine] ~ $ netstat -ant | grep 1099
tcp6       0      0 :::1099                 :::*                    LISTEN     
tcp6       0      0 10.1.1.1:1099         10.1.1.2:33400        ESTABLISHED
tcp6       0      0 10.1.1.1:1099         10.1.1.1:33378        ESTABLISHED
tcp6       0      0 10.1.1.1:33408        10.1.1.1:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:1099         10.1.1.1:33408        ESTABLISHED
tcp6       0      0 10.1.1.1:46866        10.1.1.2:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:1099         10.1.1.2:33404        ESTABLISHED
tcp6       0      0 10.1.1.1:33378        10.1.1.1:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:46862        10.1.1.2:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:46864        10.1.1.2:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:1099         10.1.1.2:33402        ESTABLISHED
tcp6       0      0 10.1.1.1:46860        10.1.1.2:1099         ESTABLISHED

10.1.1.1 and 10.1.1.2 are both RMI servers and clients talking to each other.

This is my code snippet:

IRemoteService stub = (IRemoteService) UnicastRemoteObject.exportObject(service, 1099);

registry = LocateRegistry.createRegistry(1099);

registry.rebind(IRemoteService.serviceName, stub);

Is this expected? Why am I seeing port #'s like 33400, 33378 etc? Or is my understanding of how source and destination ports work wrong? I was hoping to see all connections (registry lookup and remote service calls) going to port 1099 only.

Note: I did not run the above in a Firewall environment yet, just trying locally in my lab before I try in a Firewall situation.

Community
  • 1
  • 1
Say No To Censorship
  • 537
  • 1
  • 15
  • 32

1 Answers1

1
tcp6       0      0 10.1.1.1:1099         10.1.1.2:33400        ESTABLISHED

A connection between a client on port 33400 and a server on port 1099. You can't tell that from this line alone but you mentioned RMI which uses 1099, and there would have been a prior line with 1099 LISTENING.

tcp6       0      0 10.1.1.1:1099         10.1.1.1:33378        ESTABLISHED

A connection between a client on port 33378 and a server on port 1099. Same remark as above.

tcp6       0      0 10.1.1.1:33408        10.1.1.1:1099         ESTABLISHED

A connection between a client on port 33408 and a server on port 1099. Same remark as above. If the client was on a different host, this line would only show at the client host.

tcp6       0      0 10.1.1.1:1099         10.1.1.1:33408        ESTABLISHED

The other side of that connection. This line only shows at the server host.

tcp6       0      0 10.1.1.1:46866        10.1.1.2:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:1099         10.1.1.2:33404        ESTABLISHED
tcp6       0      0 10.1.1.1:33378        10.1.1.1:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:46862        10.1.1.2:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:46864        10.1.1.2:1099         ESTABLISHED
tcp6       0      0 10.1.1.1:1099         10.1.1.2:33402        ESTABLISHED
tcp6       0      0 10.1.1.1:46860        10.1.1.2:1099         ESTABLISHED

Et cetera.

Is this expected?

Yes.

Why am I seeing port #'s like 33400, 33378 etc?

Because connections have two ends: a server end and a client end, and the client port is normally chosen fairly randomly.

Or is my understanding of how source and destination ports work wrong? I was hoping to see all connections (registry lookup and remote service calls) going to port 1099 only.

They are. But there are client ends to those connections.

This is really a question about TCP and netstat, not RMI or Java.

user207421
  • 305,947
  • 44
  • 307
  • 483
  • I guess my real question is ports like `33404` (10.1.1.1:1099 `->` 10.1.1.2:33404) need to be opened on Firewall apart from 1099? – Say No To Censorship Feb 27 '17 at 05:28
  • So are you saying only server ports (1099) need to be opened up on Firewall, not client ports (33408, 33404 etc.)? – Say No To Censorship Feb 27 '17 at 05:41
  • I haven't said anything about firewalls, and I am totally and utterly allergic to 'so are you saying' questions, as the answer is invaraibly 'no', as it is here, but as you *now* ask it, as a *new* question, the server-side firewall must allow inbound connections on 1099 (and 10991 per your previous question); the client-side firewall must allow outbound connections to those ports; and neither firewall should make any ruling whatsoever about source ports. There is nothing to be gained by so doing. – user207421 Feb 27 '17 at 05:48
  • "neither firewall should make any ruling whatsoever about source ports" - Ok, thanks for clarification. Clear now. – Say No To Censorship Feb 27 '17 at 05:53