TCP Connections

• Outbound new connections often from dynamic (unpredictable) src port

  • Can't use firewall rule based on src port

• Destination may be “well-known” port

  • But not always

• Destination may move to dynamic port during connection establishment