[unisog] Port 0

Valdis.Kletnieks@vt.edu Valdis.Kletnieks at vt.edu
Thu Oct 27 20:01:39 GMT 2005

On Thu, 27 Oct 2005 15:04:13 EDT, "Christensen, Eric" said:

> This is interesting...
> It actually is showing source port 0, destination port 0,
> type:8/subtype:0...
> So as you said it was a response to a PING.  Is a PING on a specific port?

No. PING is an ICMP Echo - and ICMP doesn't use ports.

If a host or router is sending an ICMP Error packet (host/port unreachable,
and so on), what it will do is send an ICMP packet back with the type/code set
to reflect why it's unreachable, and (hopefully) enough of the *original* packet
header for the original source to figure it out.  So basically, all it sends back
is "No Route From Here To There, and here's the packet that died.  Hopefully,
you can poke around in it and figure out what you were doing".

Consider it the equivalent of a post office "Returned Mail" sticker - you have
to look at the letter yourself to figure out who/what didn't get delivered. All
the Post Office cares is that it didn't deliver it, and it told you.  Any context
is your problem....
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/unisog/attachments/20051027/9a6ec6ce/attachment.bin

More information about the unisog mailing list