On Thu, Nov 07, 2002 at 06:44:49PM -0600, Len Conrad wrote:
> 
> >I've got a log full of these entries. Meaning?
> >
> >20-Oct-2002 06:38:30.000 security: notice: dropping source port zero 
> >packet from
> >[2.64.32.33].0
> 
> As Scott indicated, totally bogus.
> 
> See:
> 
> http://www.cymru.com/Documents/secure-bind-template.html, for Rob's bogon 
> blackhole.
> 
> 2.0.0.0/8 is not a valid IANA reverse domain.
> 
Indeed. This set of packets is nothing but trouble, as are virtually all
source port 0 packets. There used to be a sysadmin at one of the large
NSPs (I want to say sprintlink here, but I don't recall with 100%
certainty) who was very fond of using port 0 as a query source port,
but that nonsense seems to have finally stopped.

-Pete

Replies

[isp-dns] What to make of "source port zero packet" log entriies, Jim McAtee

[isp-dns] Re: What to make of "source port zero packet" log entriies, Len Conrad