tcp port zero...

Russell Fulton r.fulton at auckland.ac.nz
Sun Apr 22 18:19:42 EDT 2001


HI,
	I know I have asked this before but I have lost the reply 
(sigh...)

I am seeing a sprinkling of argus records with tcp port 0 :

2001-04-22-00:47:39		tcp	152.66.99.19	0	?>	130.216.134.85	1024	1	0	0	0	RA
2001-04-22-00:47:55		tcp	152.66.99.19	0	?>	130.216.235.39	1024	1	0	0	0	RA
2001-04-22-00:51:33		tcp	63.237.94.41	0	?>	130.216.116.106	1024	1	0	0	0	RA
2001-04-22-00:52:57		tcp	63.237.94.41	0	?>	130.216.136.116	1024	1	0	0	0	RA
2001-04-22-00:55:17		tcp	63.237.94.41	0	?>	130.216.184.126	1024	1	0	0	0	RA
2001-04-22-00:56:12		tcp	63.237.94.41	0	?>	130.216.240.53	1024	1	0	0	0	RA
2001-04-22-01:43:57		tcp	172.16.1.253	1593	?>	130.216.35.105	0	1	0	0	0	R
2001-04-22-01:43:58		tcp	172.16.1.253	1584	?>	130.216.35.105	0	1	0	0	0	R
2001-04-22-01:44:20		tcp	172.16.1.253	1597	?>	130.216.35.105	0	1	0	0	0	R
2001-04-22-01:44:20		tcp	172.16.1.253	1595	?>	130.216.35.105	0	1	0	0	0	R
2001-04-22-02:34:25		tcp	24.226.30.55	0	?>	130.216.6.79	3072	1	0	0	0	RA
2001-04-22-03:09:48		tcp	195.132.225.24	0	?>	130.216.72.64	3072	1	0	0	0	RA
2001-04-22-03:11:31		tcp	195.132.225.24	0	?>	130.216.231.3	1024	1	0	0	0	RA
2001-04-22-04:33:31		tcp	208.185.175.154	0	?>	130.216.151.26	3072	1	0	0	0	RA
2001-04-22-04:34:24	I	tcp	208.185.175.154	0	?>	130.216.32.32	3072	1	0	0	0	RA
2001-04-22-04:34:47		tcp	208.185.175.154	0	?>	130.216.210.72	3072	1	0	0	0	RA
2001-04-22-04:36:13		tcp	208.185.175.154	0	?>	130.216.232.104	1024	1	0	0	0	RA
2001-04-22-04:36:33		tcp	208.185.175.154	0	?>	130.216.178.81	3072	1	0	0	0	RA
2001-04-22-04:36:47		tcp	208.185.175.154	0	?>	130.216.118.57	3072	1	0	0	0	RA
2001-04-22-04:37:00		tcp	208.185.175.154	0	?>	130.216.13.73	3072	1	0	0	0	RA
2001-04-22-04:37:04		tcp	208.185.175.154	0	?>	130.216.215.90	3072	1	0	0	0	RA
2001-04-22-04:37:10		tcp	208.185.175.154	0	?>	130.216.212.109	1024	1	0	0	0	RA
2001-04-22-04:37:23		tcp	208.185.175.154	0	?>	130.216.45.89	1024	1	0	0	0	RA
2001-04-22-04:37:24		tcp	208.185.175.154	0	?>	130.216.38.107	1024	1	0	0	0	RA
2001-04-22-04:37:30		tcp	208.185.175.154	0	?>	130.216.114.67	1024	1	0	0	0	RA
2001-04-22-04:37:35		tcp	208.185.175.154	0	?>	130.216.96.74	3072	1	0	0	0	RA
2001-04-22-04:37:38		tcp	208.185.175.154	0	?>	130.216.7.124	3072	1	0	0	0	RA
2001-04-22-04:38:03		tcp	208.185.175.154	0	?>	130.216.209.110	3072	1	0	0	0	RA
2001-04-22-04:38:03		tcp	208.185.175.154	0	?>	130.216.208.39	1024	1	0	0	0	RA
2001-04-22-04:38:13		tcp	208.185.175.154	0	?>	130.216.58.109	1024	1	0	0	0	RA
2001-04-22-04:38:17		tcp	208.185.175.154	0	?>	130.216.211.75	1024	1	0	0	0	RA
2001-04-22-04:38:19	I	tcp	208.185.175.154	0	?>	130.216.35.38	3072	1	0	0	0	RA
2001-04-22-04:39:07		tcp	208.185.175.154	0	?>	130.216.124.87	1024	1	0	0	0	RA
2001-04-22-04:39:15		tcp	208.185.175.154	0	?>	130.216.219.64	3072	1	0	0	0	RA
2001-04-22-04:39:44		tcp	208.185.175.154	0	?>	130.216.206.62	1024	1	0	0	0	RA
2001-04-22-04:40:09		tcp	208.185.175.154	0	?>	130.216.123.51	1024	1	0	0	0	RA
2001-04-22-04:42:06		tcp	208.185.175.154	0	?>	130.216.165.57	1024	1	0	0	0	RA
2001-04-22-04:42:16		tcp	208.185.175.154	0	?>	130.216.185.42	1024	1	0	0	0	RA
2001-04-22-04:42:51		tcp	208.185.175.154	0	?>	130.216.99.12	3072	1	0	0	0	RA
2001-04-22-04:43:07		tcp	208.185.175.154	0	?>	130.216.134.10	1024	1	0	0	0	RA
2001-04-22-04:44:02		tcp	208.185.175.154	0	?>	130.216.29.28	3072	1	0	0	0	RA
2001-04-22-04:44:18		tcp	208.185.175.154	0	?>	130.216.83.44	1024	1	0	0	0	RA
2001-04-22-04:45:05		tcp	208.185.175.154	0	?>	130.216.132.73	3072	1	0	0	0	RA
2001-04-22-04:45:12		tcp	208.185.175.154	0	?>	130.216.216.113	3072	1	0	0	0	RA
2001-04-22-04:45:40		tcp	208.185.175.154	0	?>	130.216.57.91	3072	1	0	0	0	RA
2001-04-22-04:46:24		tcp	208.185.175.154	0	?>	130.216.96.125	3072	1	0	0	0	RA
2001-04-22-05:35:57		tcp	216.230.133.212	1	?>	130.216.224.33	0	1	0	0	0	R
2001-04-22-07:26:08		tcp	216.103.43.122	0	?>	130.216.178.108	3072	1	0	0	0	RA
2001-04-22-07:42:34		tcp	216.103.43.122	0	?>	130.216.186.38	3072	1	0	0	0	RA
2001-04-22-07:59:58		tcp	24.22.106.29	0	?>	130.216.22.126	1024	1	0	0	0	RA
2001-04-22-11:40:45		tcp	63.147.195.222	0	?>	130.216.240.110	1024	1	0	0	0	RA
2001-04-22-11:43:24		tcp	63.147.195.222	0	?>	130.216.191.62	1024	1	0	0	0	RA
2001-04-22-14:56:13		tcp	62.82.66.34	0	?>	130.216.174.90	1024	1	0	0	0	RA
2001-04-22-17:34:01		tcp	202.143.71.42	0	?>	130.216.191.67	1767	1	0	0	0	RPA7
2001-04-22-22:56:42		tcp	24.240.93.18	0	?>	130.216.97.82	3072	1	0	0	0	RA
2001-04-22-23:05:24		tcp	24.67.113.99	0	?>	130.216.146.69	3072	1	0	0	0	RA
2001-04-22-23:05:36		tcp	24.67.113.99	0	?>	130.216.187.81	1024	1	0	0	0	RA
2001-04-22-23:05:46		tcp	24.67.113.99	0	?>	130.216.202.33	3072	1	0	0	0	RA
2001-04-22-23:06:51		tcp	24.67.113.99	0	?>	130.216.198.79	3072	1	0	0	0	RA
2001-04-22-23:08:18		tcp	24.67.113.99	0	?>	130.216.89.9	1024	1	0	0	0	RA
2001-04-22-23:08:20		tcp	24.67.113.99	0	?>	130.216.211.123	1024	1	0	0	0	RA

Would someone please refresh my memory as to what these represent.  I 
seem to remember that these can be either packets with a the port 
number set to zero (I think that's the case here) but they can also 
represent agregated records (not possible here since I have not done 
any port aggregation).  Is there any other interpretation.

Anyone have any ideas as to what caused these packets, seems 
significant that they are all resets.  My best guess is that these are 
fall out from a DoS against the sending system using random port 
numbers and IP addresses.


Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand



More information about the argus mailing list