The curious case of port 0

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

3 Citations (Scopus)

Abstract

In order to direct network traffic towards applications, transport layer protocols such as TCP and UDP add the notion of a port number. A share of these numbers is registered for well-known services such as a web or mail, while some is left to be dynamically assigned by the OS to client connections. A special case is port 0 which is reserved but was never assigned. Traffic from and to port 0 is unusual, because it should not occur in the wild. As port 0 is unassigned, there is no common service listing for connections here. Furthermore, operating systems usually interpret the request to open port 0 as the request to allocate and open any currently unused port. Thus, traffic from and to port 0 should not occur, because no application should listen there and applications cannot send from port 0. In practice, we do however see traffic from and to port 0, which indicates that someone makes the effort to bypass the normal operating system network stack to create these unusual packets. As a corner case of network protocols, the aspect of port 0 has basically never been thoroughly investigated. In this paper, we analyze network traffic collected through a /15 network telescope over a period of 3 years to characterize these curious data flows. We find that port 0 traffic seems to be used in the wild by a select few for a variety of purposes, from DDoS attacks to system fingerprinting, and that some of these actors possess a surprisingly sophisticated knowledge of OS behavior.

Original languageEnglish
Title of host publication2019 IFIP Networking Conference, IFIP Networking 2019
PublisherIEEE
Pages1-9
Number of pages9
ISBN (Electronic)978-3-903176-16-4
ISBN (Print)978-1-7281-3671-4
DOIs
Publication statusPublished - 1 May 2019
Event2019 IFIP Networking Conference, IFIP Networking 2019 - Warsaw, Poland
Duration: 20 May 201922 May 2019

Publication series

Name2019 IFIP Networking Conference, IFIP Networking 2019

Conference

Conference2019 IFIP Networking Conference, IFIP Networking 2019
CountryPoland
CityWarsaw
Period20/05/1922/05/19

Keywords

  • back scatter
  • port 0
  • port scanning

Fingerprint

Dive into the research topics of 'The curious case of port 0'. Together they form a unique fingerprint.

Cite this