demo ยท v139

Port Allocation Simulator

Chrome 139 randomizes TCP source ports on eligible Windows releases instead of walking the ephemeral range in order. The simulator keeps the same held-port pressure for both strategies so the security, collision, and exhaustion branches are visible side by side.

simulation controls

16,384 ports
25% in TIME_WAIT
The same occupied ports are used for both allocators.
96 new sockets
24 hidden sockets
A low value makes collision pressure easy to see.
24 queued or reused
- free ephemeral ports
- sequential next-port window
- randomized search space
- fallback branch

pre-v139 Windows

Sequential allocation

opened-
held-port skips-
queued/reused-
failed connects-
attacker clue-
No trial has run yet.

Sequential assignment avoids some reuse by walking forward, but every successful allocation moves the next guess by a visible amount.

Chrome 139 on eligible Windows

Randomized allocation

opened-
collision retries-
queued/reused-
failed connects-
attacker odds-
No trial has run yet.

Randomization hides the next source port, but a small or crowded ephemeral range creates retry pressure before the connection pool can recover.

observer view

Can another tab's connections be counted?

sequential probes-
randomized probes-
hidden sockets-

The old behavior lets an observer compare before/after source ports and estimate how many other sockets advanced the counter. Randomized ports turn the delta into noise.

trial log

Reuse and exhaustion events

Run a burst to generate the live branch log.

what the implementation changes

security

Sequential allocation makes the next source port a one-step guess once a site or network observer has seen the counter. Random allocation forces guesses across the free ephemeral pool.

reuse pressure

Random sampling can re-pick ports still held by recent connections. Chrome enables the change on Windows versions where the ephemeral range is wide enough to keep that collision rate acceptable.

fallback

When no usable source port is found, the browser and network stack have to queue, reuse idle pooled sockets, back off, or fail the connection attempt instead of opening another TCP socket.

see also