[unisog] Port 0

Ryan Dorman Ryan.Dorman at millersville.edu
Tue Nov 1 16:48:34 GMT 2005


I too have been seeing a large increase of UDP port 0 traffic on my IPS.
Its being stopped but it really took off about 2 3 weeks ago.  New worm?
New outbreak of an old worm?

-- 
Ryan Dorman, CCNP
Network Engineering Specialist
Millersville University
717.871.5883



On 10/31/05 7:39 PM, "Rudolph Pereira" <rudolph at usyd.edu.au> wrote:

> On Mon, Oct 31, 2005 at 04:40:45PM -0600, John Kristoff wrote:
>> On Tue, 1 Nov 2005 09:12:50 +1100
>> Rudolph Pereira <rudolph at usyd.edu.au> wrote:
>> 
>>> So, given that the only solid report of udp/0 traffic is actually
>>> IGMP, I'd still, for one, be interested in any other evidence that
>>> udp/0 is associated with valid traffic.
>> 
>> IGMP and UDP are mutually exclusive.  IGMP doesn't have ports anymore
>> than ICMP has ports.
> Oops, sorry. I thought florian was replying to someone who had
> misinterpreted their firewall logs as showing udp/0 traffic.
> 
> Apologies to everyone for confusing thread (replies).
> _______________________________________________
> unisog mailing list
> unisog at lists.sans.org
> http://www.dshield.org/mailman/listinfo/unisog



More information about the unisog mailing list