hide
Free keywords:
Computer Science, Networking and Internet Architecture, cs.NI
Abstract:
Transport protocols use port numbers to allow connection multiplexing on
Internet hosts. TCP as well as UDP, the two most widely used transport
protocols, have limitations on what constitutes a valid and invalid port
number. One example of an invalid port number for these protocols is port 0. In
this work, we present preliminary results from analyzing port 0 traffic at a
large European IXP. In one week of traffic we find 74GB port 0 traffic. The
vast majority of this traffic has both source and destination ports set to 0,
suggesting scanning or reconnaissance as its root cause. Our analysis also
shows that more than half of all port 0 traffic is targeted to just 18 ASes,
whereas more than half of all traffic is originated by about 100 ASes,
suggesting a more diverse set of source ASes.
