diff --git a/man7/ip.7 b/man7/ip.7 index 138cdbc6c..59a6511e1 100644 --- a/man7/ip.7 +++ b/man7/ip.7 @@ -1012,12 +1012,19 @@ was called on a socket that was not not previously bound; is called on a datagram socket that was not not previously bound. .RE .IP -Allocation starts with the first number and ends with the second number. -Note that these should not conflict with the ports used by masquerading +Allocation of ephemeral ports starts with the first number in +.IR ip_local_port_range +and ends with the second number. +If the range of ephemeral ports is exhausted, +then the relevant system call returns an error (but see BUGS) +.IP +Note that the port range in +.IR ip_local_port_range +should not conflict with the ports used by masquerading (although the case is handled). Also, arbitrary choices may cause problems with some firewall packet filters that make assumptions about the local ports in use. -First number should be at least greater than 1024, +The first number should be at least greater than 1024, or better, greater than 4096, to avoid clashes with well known ports and to minimize firewall problems. .\"