We conclude, therefore, that UDP port numbers are unreliable filtering criteria and UDP application protocols are too varied for monitoring in a filter. Partition the UDP port space between clients and servers. With the first alternative, the packet filter does not need to examine the source or destination ports. With the second alternative, the filter uses the disjoint client and server port spaces as an implicit request-response bit by verifying that the packet is destined for a UDP port in the client range. This approach assumes that all UDP implementations honor the same port space partitioning.
Servers can always explicitly bind to a port in the server range.
By using a fixed cut-point between the client and server portions, the filter rules can use a simple comparison operator which can remain unchanged even as new UDP application protocols are deployed. Even with a firewall that discards all inbound UDP packets marked as requests, external hosts can still send anything they want to a client port. Ultimately, only applications themselves have sufficient knowledge and state to perform exact request-response filtering. For example, only the client can detect and discard unsolicited responses from external hosts, as only the client knows exactly which requests are still outstanding. UDP applications receiving a request packet on a client port must treat the packet as an invalid protocol operation.