Firewall Wizards: Re: udp port 0

[rainer.ginsberg () basf-it-services com]

I believe this is a feature of IOS. If it denies packets before checking
port numbers, they are logged as port 0. E.g., if your access list denies
UDP in general, IOS doesn't have to check the port number for a decision
whether to block or accept the packet.

Best regards,
Rainer


Rainer Ginsberg
Security, Voice & Network Planning


Phone: +49 621 60-94660, Fax: +49 621 60-6694660, E-Mail:
rainer.ginsberg () basf-it-services com
Postal Address: BASF IT Services GmbH, IN-CP - C010, 67059 Ludwigshafen,
Germany


www.basf-it-services.com


BASF IT Services GmbH, Registered Office: 67059 Ludwigshafen, Germany
Companies' Register: Amtsgericht Ludwigshafen, HRB 3541
Managing Directors:
Andreas Biermann, Dr. Ralf Sonnberger
Chairman of the Supervisory Board: Andrew Pike




                                                                           
             "shadow floating"                                             
             <nadengine () google                                             
             mail.com>                                                  To 
             Sent by:                  firewall-wizards () listserv cybertrus 
             firewall-wizards-         t.com                               
             bounces () listserv                                           cc 
             cybertrust.com                                                
                                                                   Subject 
                                       [fw-wiz] udp port 0 (Plain)         
             04.02.2008 18:00                                              
                                                                           
                                                                           
             Please respond to                                             
             Firewall Wizards                                              
             Security Mailing                                              
                   List                                                    
             <firewall-wizards                                             
             @listserv.cybertr                                             
                 ust.com>                                                  
                                                                           
                                                                           




Hi list
i keep getting logs from my IOS router 12.4 T about denying udp packet
ip a.a.a.a (0) --> b.b.b.b (0)
i kept googling about udp port zero and it's apperantly not used , at
least legitimately. I also inspected the traffic from the logged ip
address via wireshark and it never captures and udp packet with src or
dst port 0, but i still get these logs all day long.
anyone got idea about what it? is it some kind like udp tracerouting ?
thanks alot

regards,
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards