Strange Port 0 Traffic
Date: 11/13/03

  • Next message: Thompson, Jimi: "RE: SQL Slammer doing the rounds again?"
    To: <>
    Date: Thu, 13 Nov 2003 16:41:12 -0600

    I am seeing a lot of traffic lately coming from different external
    sources using UDP originating from a source port of 10000 and coming to
    my various firewall addresses with a destination port of 0.

    I ran tcpdump traces for this traffic both internally and externally for
    about 2 weeks. The traces showed no internal servers/desktops/devices
    making these connections, only external machines sending these packets
    to the firewalls.

    The data in the packet is gibberish; looks like it might be encrypted.
    Is anyone else seeing this kind of traffic?

    Attached is a sanitized trace of some of these packets.

    Josh Berry
    Information Security Group


    Network with over 10,000 of the brightest minds in information security
    at the largest, most highly-anticipated industry event of the year.
    Don't miss RSA Conference 2004! Choose from over 200 class sessions and
    see demos from more than 250 industry vendors. If your job touches
    security, you need to be here. Learn more or register at
    and use priority code SF4.

  • Next message: Thompson, Jimi: "RE: SQL Slammer doing the rounds again?"

    Relevant Pages

    • Strange traffic from my DSL router
      ... My home computing setup consists of a single multiboot PC and a Westell 6100-E90 DSL modem/router. ... I've observed a bizarre pattern of packets being issued by the Westell 6100. ... The first request after boot logged by iptables in /var/log/messages has a source port of 1032. ...
    • Re: NIS 2003 dropped packets
      ... I've installed NIS 2003 and am getting many records in the firewall log like ... TCP Destination Port: 1163 ... If so, then looking at the source port, it is likely just a late ... NIS2003 scrutinizes incoming packets closer than previous versions and it is ...
    • Re: use ipchains to block all ports > 60,000
      ... packets you sent out without allowing other incoming packets from the ... certain) that the packets from source port> 60K are masqueraded. ... firewall rule. ... If you are masquerading and you do put this rule in, ...
    • RE: Increase in TCP 6129 (Dameware) scans?
      ... tcpdump: WARNING: xl1: no IPv4 address assigned ... The sequence numbers of the TCP packets remain the same ... I assume it would increment the source port by one and also increment the ... > are just sniffing for machines that are listening on ...
    • Re: Variant or original posting to packetstormsecurity - long
      ... > see in the traces below. ... I don't know if it's b/c of the compiler ... > that I used that caused this to use the source port of 53 or what ...