1

I'm on macOS Sierra and keep getting requests to allow port 59249. When I look at the request details, I see that it appears to come from github: 

lb-192.30.253.124-iad.github.com

I am using github over ssh for development work. However, when I search for the ports page on github, I see no reference to this port number (this page is for Enterprise; doesn't seem to be a similar page for non-enterprise users).

Github does say that they are currently using IP addresses 192.30.252.0/22 so I'm not sure where this is coming from.

Any insight would be most appreciated.

Improve this question

1 Answer 1

Reset to default
4

Most likely, your firewall is just interpreting an outgoing connection backwards.

  • All TCP connections have an address and port on both ends. When you connect to GitHub (on port 22 or 443 or such), the connection comes from a randomly selected port number, usually in the range 49152–65535 or 32768–65535 or such.

    For example, a SSH connection might be 192.168.1.x:59249 <--> 192.30.253.124:22.

  • The only difference between "incoming" and "outgoing" connections is the initial handshake. Once the connection gets established, everything becomes fully symmetric.

    So if you only start a firewall after the connection has been established, and the first thing it sees is a packet from github:80 to yourpc:59249, it has no way of knowing whether the connection was originally incoming or outgoing.

    Or perhaps in your case it doesn't see outgoing "initiate connection" packets at all, but still sees the incoming responses, and thinks that it's GitHub who is initiating a connection towards you.

    This can certainly happen if you use both Ethernet and Wi-Fi at the same time: the handshake (TCP SYN) might be sent via Ethernet, but the response (SYN-ACK) might arrive via Wi-Fi; although that's quite valid, some firewalls mistakenly think they belong to different connections.

Improve this answer
4
  • Yep; Norton Security got confused and probably, as you said, because of both Ethernet & WiFi going at the same time.Nice description; thanks!
    – JESii
    Commented Nov 15, 2017 at 12:29
  • Turns out, github uses ports starting 59249 for that initial handshake request -- so that's where it's coming from.
    – JESii
    Commented Dec 11, 2017 at 16:24
  • Really? GitHub cannot possibly choose your local port for outgoing requests. Your OS chooses that.
    – grawity_u1686
    Commented Dec 11, 2017 at 17:25
  • @grawty... That's what GitHub told me when I inquired. Maybe they don't "set" it, but they certainly are the ones that are generating these requests because I was able to eventually track in down through the logs. And it's repeatable...
    – JESii
    Commented Dec 13, 2017 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .