According to the NDT cookbook, the default web100srv ports are 3001, 3002, and 3003 (http://www.internet2.edu/pubs/ndt-cookbook.pdf). This is confirmed by our own wiki: https://code.google.com/p/ndt/wiki/MLabOperations. i imagine these will need to be added as well as the ephemeral range you have.

Our config might override this, but it doesn't look like it does (i checked the ndt-support repo).

The c2s server code just tries every port until it finds an unbound one, starting at a default of 3002. So i'm not sure why you're only seing a range starting at 35000.

It will go up to the max TCP port (65535) for sure.