DDoS using port 0 and 53 (DNS)

Wed Jul 25 04:10:52 UTC 2012

On 7/24/12, Frank Bulk <frnkblk at iname.com> wrote:
> Unfortunately I don't have packet captures of any of the attacks, so I
> can't exam them for more detail, but wondering if there was some collective
> wisdom about blocking port 0.

It should be relatively safe to drop  (non-fragment)  packets to/from port 0.

If I recall correctly, there are some routers that perform a "helpful"
numeric value validation when the human is entering port numbers for
access list rules, that _do_ forward port 0 traffic,  and  through
some sort of oversight by the router/firewall vendor  actually
_prevent_ the administrator from selecting port 0 in a deny rule,  eg.
  "Port to deny must be a number from 1 to  65535".

TCP/UDP port 0 is technically a legal port,  but it's also a reserved
port, and very unusual for it to be used on the network for any
legitimate purpose.   Various firewalls will discard anything TCP/UDP
sent to/from port 0.

Many TCP/UDP sockets implementations won't even let an application
select port 0. bind() to port 0  is treated as a signal that the
application wants the sockets API to pick a high-numbered ephemeral
port.

> Regards,
> Frank
--
-JH