[Snort-users] tcp port 0 rule
Bob Van Cleef
vancleef at ...211...
Fri Oct 11 09:52:06 EDT 2002
Saw the following scan entry in my alert log:
[**] [1:524:3] BAD TRAFFIC tcp port 0 traffic [**]
[Classification: Misc activity] [Priority: 3]
10/09-02:34:18.941743 184.108.40.206:0 -> 220.127.116.11:0
TCP TTL:242 TOS:0x0 ID:65259 IpLen:20 DgmLen:40
*****R** Seq: 0xE59FF019 Ack: 0xE5B5A1E5 Win: 0xF018 TcpLen: 20
However, when I looked into the rules I noted the following:
bad-traffic.rules:alert tcp $EXTERNAL_NET any <> $HOME_NET 0 (msg:"BAD
TRAFFIC tcp port 0 traffic"; reference:cve,CVE-1999-0675;
reference:nessus,10074; classtype:misc-activity; sid:524; rev:4;)
The test is for TCP port 0, however the CVE-1999-0675 reference states:
"Firewall-1 can be subjected to a denial of service via UDP packets that
are sent through VPN-1 to port 0 of a host."
So, two questions:
1 - if the attack is UDP based, why is the rule looking at TCP?
2 - is there anything wrong with TCP port 0 connection attempts?
The process can let the system automatically assign a port. For
both the Internet domain and the XNS domain, specifying a port
number of 0 before calling bind() requests the system to do this.
More information about the Snort-users