topic Re: Question about consumption process fwd and port 1024/tcp in Firewall and Security Management

Question about consumption process fwd and port 1024/tcp

guiausechi — Tue, 31 May 2022 17:54:48 GMT

Hello guys,

I would like to ask you about a question. We recently deployed a cluster environment
on a client. And I have seen a throughput that is quite considerable, but I have followed
seen a high consumption of port 1024/tcp and the FWD process. Maybe that's because
80% of the traffic is going through Medium Path(CPASXL)?

Version.: R80.40 - Take 158
Memory.: 24 GB
6 vCPU (4 fw / 2 snd)
HyperThreading.: yes

Something I've been thinking is wrong, practically every second has been running a trace in the fwd process and saved in /var/log/messages.

Thank you!

Re: Question about consumption process fwd and port 1024/tcp

the_rock — Tue, 31 May 2022 18:02:19 GMT

Interesting...lots of things can use tcp port 1024, fwd is on port 257 though. Do you have port 1024 configured specifically in lots of policy rules?

Re: Question about consumption process fwd and port 1024/tcp

guiausechi — Tue, 31 May 2022 18:39:40 GMT

Hello the_rock,

I understood this too, but see, there is a process the fwd on the port 1024/tcp.:

So-so..10 rules that have port 1024, total 265 rules in the firewall. But in tcpdump or fw monitor I see very little traffic on port 1024/tcp passing.

Re: Question about consumption process fwd and port 1024/tcp

JanVC — Thu, 09 Jun 2022 06:01:28 GMT

read sk116876 for the true meaning of TCP 1024 in cpview 🙂

(spoiler: it means any high port and not specifically TCP 1024)