Last Updated: 2009-10-02 18:59:20 UTC
by Stephen Hall (Version: 1)
The second day of Cybersecurity Awareness Month is dedicated to the strange, and anomalous port number, 0.
It is possible to specify a socket only partially by setting the PORT
identifier to zero or setting both the TCP and PORT identifiers to
zero. A socket of all zero is called UNSPECIFIED. The purpose behind
unspecified sockets is to provide a sort of "general delivery"
facility [useful for logger type processes with well known sockets].
"alert tcp $EXTERNAL_NET any <> $HOME_NET 0 (msg:"BAD-TRAFFIC tcp port 0 traffic"; flow:stateless; classtype:misc-activity; sid:524; rev:8;)"