Re: What is port 3 used for?

From: Barry Margolin (barmar@genuity.net)
Date: 03/25/02


From: Barry Margolin <barmar@genuity.net>
Date: Mon, 25 Mar 2002 19:17:42 GMT

In article <a7hpdv$7ua$1@sapa.inka.de>,
Bernd Eckenfels <ecki-news2002-03@lina.inka.de> wrote:
>Ajmo <alanjohnmoore@yahoo.com> wrote:
>> Mar 19 18:01:17 xxxx kernel: Packet log: output REJECT eth1 PROTO=1
>> x.x.x.x:3: 204.215.60.153 3 L=92 S=0xC0 I=49567 F=0x0000 T=255 (#34)
>
>This is ICMP

And ICMP type 3 is Destination Unreachable, a pretty common ICMP packet.
If that '3' between 204.215.60.153 and L=92 is the code, it's Port
unreachable; your machine will send this whenever it receives a UDP packet
addressed to a port that isn't in use. If someone is port scanning you,
you'll send out a bunch of these.

-- 
Barry Margolin, barmar@genuity.net
Genuity, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.



Relevant Pages

  • Re: Survive without ICMP?
    ... You may close port 0 and test your machine. ... port 0 which are a very low security risk. ... Another is an icmp timestamp request and reply. ... Research icmp type 13 and icmp type 14 both found through Google. ...
    (comp.security.firewalls)
  • Re: ICMP on port 3
    ... ICMP doesnt use ports, what made you think it was port 3? ... with ICMP Type or Code. ... Regards, ...
    (Security-Basics)
  • Re: ipfw-ntad-jail
    ... > Ok, so I setup IPFW and NATd on my freeBSD 4.5-RELEASE box, ... > host (dagobah) ... > allow ftp (port 21) ... > add 00600 allow icmp from any to any icmptypes 3 ...
    (FreeBSD-Security)
  • Re: Survive without ICMP?
    ... ICMP resides above IP protocol, ... it receives a UDP or TCP packet on port 0 would be packets ... ICMP Type 3 Code 3 (Port unreachable). ... when it receives a TCP packet to a forbidden port which may ...
    (comp.security.firewalls)
  • Re: Survive without ICMP?
    ... > an Orion modem, Linksys programmable router, three machines ... > Linksys router responding to port 0 requests. ... > a timestamp ICMP did make it through to our hack testing. ... > the ICMP packet for a netmask. ...
    (comp.security.firewalls)