Printable View
I`m running Pure Secure IDS, i have just come to check the logs and have noticed that their are about 40 warnings of "BAD TRAFFIC tcp port 0 traffic". They all come from the same IP address which appears to be a Norway ASDL connection.
I have not seen this type of report before so if anyone could shed any light on this i`d be grateful.
mark
This should help.
Quote:
Port 0 OS Fingerprinting
As port 0 is reserved for special use as stated in RFC 1700. Coupled with the fact that this port number is reassigned by the OS, no traffic should flow over the internet use this port. As the specifics are not clear different OS's have, different ways of handling traffic using port 0 thus they can be fingerprinted.
I don't really have an answer to your question but I remember reading about something similar on bugtraq a while back.
http://www.securityfocus.com/archive/75/319981
That is the email that went out to the "incidents" list.
cheers for those links.
I`ve decided just to drop all packets form the IP address, still cant figure out though why their was so many attempts to connect to that port.
mark