Re: Attacking on Source Port 0 (ZERO)

["Dobbins, Roland" <rdobbins () arbor net>]

On Oct 14, 2012, at 4:48 PM, Shahab Vahabzadeh wrote:

> Does any body know what kind of attack can be come to port 0?

If it's protocol 0, instead of port 0, it's likely a packet-flooding DDoS attack.

If it's port 0, you may be incorrectly blocking non-initial fragments.  Alternately, it could represent a fragmented 
DDoS attack, either non-initial fragments fired directly against something on your network or as the result of a DNS 
reflection/amplification attack against something on your network.

The log fragment you posted doesn't provide enough detail to make an informed judgement.  Also, you should not place 
servers behind a stateful firewall, anyways.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins () arbor net> // <http://www.arbornetworks.com>

          Luck is the residue of opportunity and design.

                       -- John Milton