Juniper SRX Series

Chapter 12. AppSecure Basics

Digging up any computer networking reference material from the 1990s and early 2000s will surely emphasize that application servers listen on “well-known” ports for communication, including the infamous HTTP on TCP port 80. Although many of these conventions are still honored today, we must recognize several facts that have changed since the earlier days of the Internet. First—and this has always been the truth—no application must listen on a particular port or protocol. The only thing that must be true is that the client and server are speaking the same application layer protocol on the expected ports or protocols, and that all transit networking equipment must understand how to forward packets between the client and the server. Over time, web browsers gained popularity and became ubiquitous for virtually any network-capable device. At the same time, server-side technology for HTTP became much more powerful with both open source and commercial tools for not only the web servers themselves, but a plethora of server-side technologies that could bring a dynamic user experience that was once only possible with full client applications. This, coupled with the fact that most computer network administrators allowed only certain ports out of their network (chiefly TCP port 80 for HTTP), gave web technologies even more popularity as communication protocols.

During this time, both nefarious and undesirable parties took notice of the shift in access control and ...