Re: udp port 0

[Tony Rall <trall () almaden ibm com>]

On Tuesday, 2008-02-05 at 08:21 EST, "Darden, Patrick S." 
<darden () armc org> wrote:
> I think you are right. udp 0 is used variously as
>
> next available port (dynamic port assignment)for some Unices
> dos attack on early version of cp fw1

Port 0 can also be caused by an access filter that doesn't specify the 
port - like:

deny udp 1.2.3.4 any log

IOS logs all udp hitting this rule as port 0.

If I want to see the ports in the log, I usually use:

deny udp 1.2.3.4 any gt 0 log

(Of course, then I definitely won't see any real port 0 usage.)

--
Tony Rall

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards