What does a zero source port number indicate? Can Netflow tell about something a connection that is not TCP or UDP?



A zero port number usually indicates that the session in question is an IP protocol that does not use port numbers. NetFlow can report on any IP session. The current list of IANA-assigned protocol numbers is available here. There's a good chance you're seeing some ICMP traffic, for example.

Depending on the version of NetFlow, there are a number of optional fields. NetFlow 5 is pretty limited, but NetFlow 9/IPFIX can include QoS, TCP flags, VLAN, and other fields, including vendor-specific fields.

I see in your comment above that your NetFlow source is inside your firewall. If your probe is on the same host/device as your firewall, many exporters report on PRE-firewall traffic, so you could well be seeing an external scan. You should also consider the possibility of a malware infection, which could result in internal scanning behavior.

  • as to mine taste too much guess-works and unrelated stuff, but first 2 paragraphs are just ok. Here goes my vote up – poige Jan 18 '19 at 17:35

Netflow is Cisco protocol, it allows only:

  • Source IP address
  • Destination IP address
  • Source port for UDP or TCP, 0 for other protocols
  • Destination port for UDP or TCP, type and code for ICMP, or 0 for other protocols
  • IP protocol
  • Ingress interface (SNMP ifIndex)
  • IP Type of Service

According to RFC1700, both TCP and UDP 0 are reserved, but valid. Since the behavior for connections established on those ports is undefined in the spec, different OSes handle the case differently; that behavior can be used to fingerprint the dest host's OS. You're getting scanned, basically.

  • Impossible that I'm getting scanned, because my Netflow source is inside the firewall. – Spresso Jul 12 '11 at 21:34
  • then you should have stated that in your question. – MrTuttle Jul 12 '11 at 21:38

I can see the following possibilities for the port value zero with conjunction of TCP or UDP protocol

  • the port number is indeed zero
  • the IP traffic has been fragmented

I think it's a drawback of netflow that these two situations may be impossible to differentiate because scrooges from Cisco skimped on one more byte for the port field so there is no space for a Null value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.