RFC 6056

RFC 6056

RFC 6056 is a Best Current Practice (BCP) document that provides recommendations for selecting ephemeral transport protocol ports to improve robustness and resist attacks. The document addresses port allocation strategies for Transmission Control Protocol, User Datagram Protocol, and related protocols in the Internet Protocol Suite, offering guidance to implementers at organizations such as the Internet Engineering Task Force, Internet Assigned Numbers Authority, and operational bodies like IANA registries and network operators.

Background

RFC 6056 situates its guidance in the context of prior work on port allocation, referencing operational practices from entities including Cisco Systems, Juniper Networks, Microsoft Corporation, Google, and research from institutions like MIT Lincoln Laboratory and Carnegie Mellon University. It builds on standards produced by the Internet Engineering Task Force working groups such as IETF Working Group outputs and interacts with registries curated by the Internet Assigned Numbers Authority. The document considers threats studied by researchers at Stanford University, University of California, Berkeley, and Princeton University, and draws on historical incidents involving actors like Conficker and events analyzed by CERT Coordination Center and SANS Institute.

Recommendations

RFC 6056 recommends strategies such as per-socket randomization, port-picture space reduction, and allocation policies that mirror work from RFC 1948 and other IETF documents. It advises implementers at vendors such as Apple Inc., IBM, and Oracle Corporation to adopt uniform ephemeral port ranges and entropy sources informed by libraries developed at OpenSSL Project, LibreSSL, and cryptographic work from NIST. The recommendations aim to mitigate exploits similar to campaigns attributed to groups documented by Mandiant and mitigations discussed in analyses by Krebs on Security and academic papers from ETH Zurich. Operators at service providers like AT&T, Verizon Communications, and Deutsche Telekom are encouraged to coordinate with regional bodies such as RIPE NCC, ARIN, and APNIC when changing allocation policies.

Implementation Considerations

Implementers must consider platform constraints across systems like Linux kernel, FreeBSD, Microsoft Windows, and macOS, and integrate with stacks provided by vendors including Cisco Systems and Juniper Networks. The document highlights interactions with libraries such as glibc, musl, and runtime environments like Java Virtual Machine and .NET Framework. It emphasizes testing using toolchains from GNU Project, continuous integration platforms like Jenkins, and analysis using packet-capture tools from Wireshark Foundation and fuzzing frameworks influenced by work at Google Project Zero. Coordination with standards bodies such as IETF and registry operations at IANA and regional registries is recommended for compatible deployment across infrastructures operated by enterprises like Amazon Web Services, Microsoft Azure, and Google Cloud Platform.

Security Considerations

Security analysis in RFC 6056 references threat models studied by researchers at SRI International, RAND Corporation, and university groups at University of Cambridge and Imperial College London. The guidance addresses risks from blind in-window attacks exemplified in historical analyses by CERT Coordination Center and countermeasures comparable to those recommended after incidents involving Stuxnet and large-scale botnets tracked by Shadowserver Foundation. Implementers are urged to use entropy sources vetted via standards from NIST and cryptographic libraries audited by firms such as KPMG and Deloitte, and to monitor deployments using security operations centers like those run by FireEye and Palo Alto Networks.

IANA Considerations

RFC 6056 discusses coordination with the Internet Assigned Numbers Authority for ephemeral port range registries and notes implications for service registries maintained by community bodies such as IETF Registry managers and regional internet registries like LACNIC. It advises that changes to default ephemeral port ranges be communicated to standards organizations including IETF, and to vendors like Red Hat and Canonical to ensure distributions and images reflect updated allocations. The document implies cooperation with network operators and cloud providers including Cloudflare and Fastly when updating published recommendations.

Category:Internet standards