Re: Blocking UDP Port 1434

From: Sue Hoegemeier (Sue_H_at_nomail.please)
Date: 03/31/04

  • Next message: Sue Hoegemeier: "Re: Interesting issue connecting to Sql server through a firewall.." 
    Date: Tue, 30 Mar 2004 18:31:15 -0700

    Like Jasper said...you can code the port in the connection
    or use an alias
    Just to add a little clarification for you,
    UDP 1434 is used to find the port number for the instance.
    It's not used by the SQL Server instance or directly by
    clients to connect to SQL Server. It's just to enumerate the
    instances on a server and find the listening port for the
    specific instance.
    If you try to connect to SomeServer\MyNamedInstance and
    that's what you specify for the connection, it hits UDP 1434
    to use the SQL Server Resolution Service to find what port
    number SomeServer\MyNamedInstance is listening on. You can
    bypass that by specifying the port yourself and then there
    is no need to go through UDP 1434.

    -Sue

    On Tue, 30 Mar 2004 13:46:33 -0800,
    <anonymous@discussions.microsoft.com> wrote:

    >Thank you, Sue, for the input. I thought for named
    >instances, tcp ports can be coded on server and clients,
    >but NOT UDP port 1434. The following is what I get from
    >BOL. If it can be done without using UDP port 1434, how
    >should I configure the client to go through gateways?
    >
    >----------
    >'Have the network administrator configure the firewall to
    >forward the IP address and TCP port the instance of SQL
    >Server is listening on (using either 1433 for a default
    >instance, or the TCP port you configured a named instance
    >to listen on). Also configure the firewall to forward
    >requests for UDP port 1434 on the same IP address. SQL
    >Server 2000 uses UDP port 1434 to establish communications
    >links from applications.'
    >----------
    >
    >>-----Original Message-----
    >>Don't know that you can change the SQL Server Resolution
    >>Service running on UDP port 1434. However, you can still
    >>connect without using the resolution service as long as
    >the
    >>client knows the port to go through. You don't have to
    >HAVE
    >>to go through UDP 1434 to connect to a named instance.
    >>
    >>-Sue
    >>
    >>On Tue, 30 Mar 2004 12:55:25 -0800, "Wayne"
    >><anonymous@discussions.microsoft.com> wrote:
    >>
    >>>In order to protect from 'slammer' kind of virus, we are
    >>>planning to block UDP Port 1434 on all gateways. Named
    >>>instances seem to rely on UDP Port 1434. Since TCP port
    >>>the sql instance is listening on can be re-assigned, Can
    >>>we reassign the UDP port 1434 as well? Any input will be
    >>>appreciated. Thank you!
    >>
    >>.
    >>

  • Next message: Sue Hoegemeier: "Re: Interesting issue connecting to Sql server through a firewall.."

    Relevant Pages

    • Re: Block UDP Ports?
      ... I'm using Checkpoint Firewall-1. ... reasonable that Firewall-1 would leave UDP wide open. ... > UDP ICMP port unreachable scanning: This scanning method varies from the ...
      (comp.security.firewalls)
    • UDP DoS attack in Win2k via IKE
      ... This memo should clarify the issue discovered with the UDP DOS ... Sending of UDP traffic to port 500 UDP will cause windows to ... attacked host is an IPSec gateway). ...
      (Bugtraq)
    • Re: LDAP UDP Port Problem
      ... The correct fix is to identify that the network gear is tossing out the UDP ... Then I did some portqry's on the LDAP port ... > Sending LDAP query to TCP port 389... ...
      (microsoft.public.windows.server.networking)
    • Re: Block UDP Ports?
      ... UDP scanning is questionable to many - if the port is open, ... closed ports aren't even required to send an error packet. ...
      (comp.security.firewalls)
    • Re: LDAP UDP Port Problem
      ... The correct fix is to identify that the network gear is tossing out the UDP ... Then I did some portqry's on the LDAP port ... > Sending LDAP query to TCP port 389... ...
      (microsoft.public.windows.server.setup)