Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What does a zero source port number indicate? Can Netflow tell about something a connection that is not TCP or UDP?


share|improve this question

Netflow is Cisco protocol, it allows only:

  • Source IP address
  • Destination IP address
  • Source port for UDP or TCP, 0 for other protocols
  • Destination port for UDP or TCP, type and code for ICMP, or 0 for other protocols
  • IP protocol
  • Ingress interface (SNMP ifIndex)
  • IP Type of Service
share|improve this answer

According to RFC1700, both TCP and UDP 0 are reserved, but valid. Since the behavior for connections established on those ports is undefined in the spec, different OSes handle the case differently; that behavior can be used to fingerprint the dest host's OS. You're getting scanned, basically.

share|improve this answer
Impossible that I'm getting scanned, because my Netflow source is inside the firewall. – Spresso Jul 12 '11 at 21:34
then you should have stated that in your question. – MrTuttle Jul 12 '11 at 21:38

A zero port number usually indicates that the session in question is an IP protocol that does not use port numbers. NetFlow can report on any IP session. The current list of IANA-assigned protocol numbers is available here. There's a good chance you're seeing some ICMP traffic, for example.

Depending on the version of NetFlow, there are a number of optional fields. NetFlow 5 is pretty limited, but NetFlow 9/IPFIX can include QoS, TCP flags, VLAN, and other fields, including vendor-specific fields.

I see in your comment above that your NetFlow source is inside your firewall. If your probe is on the same host/device as your firewall, many exporters report on PRE-firewall traffic, so you could well be seeing an external scan. You should also consider the possibility of a malware infection, which could result in internal scanning behavior.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.