Re: [fw-wiz] udp port 0

I believe this is a feature of IOS. If it denies packets before checking
port numbers, they are logged as port 0. E.g., if your access list denies
UDP in general, IOS doesn't have to check the port number for a decision
whether to block or accept the packet.

Best regards,

Rainer Ginsberg
Security, Voice & Network Planning

Phone: +49 621 60-94660, Fax: +49 621 60-6694660, E-Mail:
Postal Address: BASF IT Services GmbH, IN-CP - C010, 67059 Ludwigshafen,

BASF IT Services GmbH, Registered Office: 67059 Ludwigshafen, Germany
Companies' Register: Amtsgericht Ludwigshafen, HRB 3541
Managing Directors:
Andreas Biermann, Dr. Ralf Sonnberger
Chairman of the Supervisory Board: Andrew Pike

"shadow floating"
<nadengine@google> To
Sent by: firewall-wizards@xxxxxxxxxxxxxxxxxx
bounces@listserv. cc
[fw-wiz] udp port 0 (Plain)
04.02.2008 18:00

Please respond to
Firewall Wizards
Security Mailing

Hi list
i keep getting logs from my IOS router 12.4 T about denying udp packet
ip a.a.a.a (0) --> b.b.b.b (0)
i kept googling about udp port zero and it's apperantly not used , at
least legitimately. I also inspected the traffic from the logged ip
address via wireshark and it never captures and udp packet with src or
dst port 0, but i still get these logs all day long.
anyone got idea about what it? is it some kind like udp tracerouting ?
thanks alot

firewall-wizards mailing list

firewall-wizards mailing list