3

I've built a new Oracle 9iR2 instance on a Windows 2003 32-bit cluster. Of course, it's version 9i for reasons out of my control. Several application servers connect to this instance, and each opens several DEDICATED connections that they keep open for their work.

This instance is in a locked-down environment, so my network guys want to seal off as many ports as possible. To do that, I need to tell them precisely what ports or port ranges the instance needs open.

I've skimmed the Listener documentation, and I can see that I can change the default Listener port of 1521. However, every connection these application servers open against the database appears to get its own TCP port.

Is there any way to limit the range of ports these servers will use to connect to the database?

Improve this question
9
  • More or less random Googling finds this: Configure the max limit for concurrent TCP connections. Perhaps it can help. – ypercubeᵀᴹ Apr 23 '12 at 16:28
  • 9i in 2012?? Who on earth would want to do that? – a_horse_with_no_name Apr 23 '12 at 17:37
  • 1
    @a_horse_with_no_name - It's part of a highly-customized third-party application. The business is unwilling to invest in properly updating the application per the vendor's recommendations. – Nick Chammas Apr 23 '12 at 17:41
  • @ypercube - Registry hacking makes me nervous, especially in a cluster where registry changes have to be replicated across all nodes. – Nick Chammas Apr 23 '12 at 18:29
  • 1
    then you dont use a dedicated connection but you use so called multithreaded or shared servers. there is a possibility to restrict the ports. i will post an answer – miracle173 Apr 25 '12 at 23:11
1

If the listener runs on port 1521 of the database server and you open a dedicated connection then the socket pair that constitutes that connection is from client:clientport to dbserver:1521.

If you have connections of the type dbserver:serverport to client:clientport than you don't have a dedicated connection but you have a multithreaded server (or shared sever in higher version) running. You can restrict the possible number of ports used by the server by configuring the ports of the dispatcher explicitly.

Oracle9i Net Services Administrator's Guide Release 2 (9.2) Part Number A96580-02

14 Configuring Shared Server

Example: Dispatcher Address with PORT To force the exact location of the dispatchers, add the PORT as follows in the init.ora file or spfile:

DISPATCHERS="(ADDRESS=(PROTOCOL=tcp) (HOST=144.25.16.201)(PORT=5000))(DISPATCHERS=1)" DISPATCHERS="(ADDRESS=(PROTOCOL=tcp) (HOST=144.25.16.201)(PORT=5001))(DISPATCHERS=1)"

Improve this answer
2
  • @Nick Chammas: Is there anything unclear with this answer? – miracle173 Apr 30 '12 at 17:48
  • Nope, thank you for posting this. Actually, more important than this answer were your comments above leading me to realize that I've been connecting to the database in SHARED and not DEDICATED mode! I haven't had a chance to look at this problem at work more thoroughly, but when I get back to it I will revisit this answer. – Nick Chammas May 1 '12 at 19:46
4

You may want to visit the Connection Manager documenatation here

I have used it to concentrate connections - we had a client that needed to access our database over a VPN. The firewall was only configured to open 1 port for all their connections. We were able to handle all their traffic over this 1 port using CMAN. Your mileage may vary though, we just used it for a handful of connections, if you are servicing dozens or hundreds of connections CMAN may run out of steam.

Your network guys should also check with the firewall vendor, there may be the ability for the firewall to open ports after the listener hands them off... So the firewall still has control over what gets opened and when after Oracle authenticates the connection. I don't know what this feature called as I am not heavy on the network side, but we had to use CMAN for some of our firewalls that did not handle this.

Improve this answer
2
  • Thank you for specifically calling out Connection Concentration. I had taken a cursory look at CMAN, but wasn't sure how it could help. The database will service well over 100 persistent connections. Do you think managing them all will be too much for CMAN? I'll check with my network guys on what our firewall can do. – Nick Chammas Apr 23 '12 at 18:23
  • All I can really say is "I don't know". Personally I wouldn't expect 1 port to take the place of dozens or hundreds of ports... But I have been working with Oracle for 10+ years and I am jaded :) Our client had less than a dozen concurrent connections and used it for ad-hoc queries so the connections were mostly idle. If you are funneling hundreds of OLTP type connections through it... it may handle it just fine I would say test it before you rely on it for production so no surprises. – David Mann Apr 23 '12 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.