security of client ephemeral ports, and possiblity of disimiliar IP routes between the client and server

Question

I'm understanding that the ephemeral port in a socket pair is a random port number that the client chooses in order for the server to respond back to. In a case where communication happens on a local network and the client has no firewall, is it possible for there to be another process on the local network that uses the ephemeral port as an open attack point while a connection is open with a server?

In the case where the client and server are not on the same subnet, is it possible for the sending of data back to the ephemeral port to be made over a different route than it is received on the server? Are there rules in the internet protocol that specifically require the same route to be used for communication in both directions?

Will the answers to my questions change if TCP or UDP are used?

Answer 1

The ephemeral port is not guaranteed to be random per se. They may be sequentially allocated.

Yes, another device on the local network could try to send packets to that open ephemeral port, possibly even spoofing the source IP address of the server that the client was talking to. This is more easily done with UDP than TCP, because with TCP you'd need to get the Sequence and Ack numbers right. But it's still doable with TCP.

Yes, packets in the same TCP or UDP flow are allowed to take different routes. That way routers can be smart about congested links and links that have gone down or come up.