Multidimensional investigation of source port 0 probing

Bou‐Harb, Elias; Lakhdari, Nour-Eddine; Binsalleeh, Hamad; Debbabi, Mourad

doi:10.1016/j.diin.2014.05.012

Cited by 27 publications

(8 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While reserved [52] but never assigned and treated as request for a system-allocated port by socket APIs, port 0 should not be observed in Internet traffic. Prior work [11,12,21,35,37,39] observed low volumes of port 0 Internet traffic. Its origin can be multifold, e.g., as target port for DDoS attacks [37] or scanning [11] and system fingerprinting [37].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks

Kopp¹,

Dietzel²,

Hohlfeld

2021

Passive and Active Measurement

View full text Add to dashboard Cite

DDoS attacks remain a major security threat to the continuous operation of Internet edge infrastructures, web services, and cloud platforms. While a large body of research focuses on DDoS detection and protection, to date we ultimately failed to eradicate DDoS altogether. Yet, the landscape of DDoS attack mechanisms is even evolving, demanding an updated perspective on DDoS attacks in the wild. In this paper, we identify up to 2608 DDoS amplification attacks at a single day by analyzing multiple Tbps of traffic flows at a major IXP with a rich ecosystem of different networks. We observe the prevalence of well-known amplification attack protocols (e.g., NTP, CLDAP), which should no longer exist given the established mitigation strategies. Nevertheless, they pose the largest fraction on DDoS amplification attacks within our observation and we witness the emergence of DDoS attacks using recently discovered amplification protocols (e.g., OpenVPN, ARMS, Ubiquity Discovery Protocol). By analyzing the impact of DDoS on core Internet infrastructure, we show that DDoS can overload backbone-capacity and that filtering approaches in prior work omit 97% of the attack traffic.

show abstract

Section: Introductionmentioning

confidence: 99%

“…Prior work [11,12,21,35,37,39] observed low volumes of port 0 Internet traffic. Its origin can be multifold, e.g., as target port for DDoS attacks [37] or scanning [11] and system fingerprinting [37]. We also observe traffic carrying port 0, yet with a very different reason: IP fragmentation.…”

Section: Introductionmentioning

confidence: 99%

DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks

Kopp¹,

Dietzel²,

Hohlfeld

2021

Passive and Active Measurement

View full text Add to dashboard Cite

show abstract

“…Even though there is traffic on port 0 in the Internet, there is little research on its root causes. Motivated by port 0 traffic spikes observed in November 2013 at the Internet Storm Center and reports from security researchers at Cisco Systems, Bou-Harb et al [9] study port 0 traffic on 30 GB of darknet data. They filter out any misconfigured traffic and packets with non-conforming TCP flags common in backscatter traffic [43].…”

Section: Related Workmentioning

confidence: 99%

“…In contrast to the related work [9,29,30], which all focus their efforts on the analysis of a single passive data source, in this paper we analyze four complementing passive datasets in addition to conducting an active measurement campaign to better understand port 0 traffic in the wild.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Zeroing in on Port 0 Traffic in the Wild

Maghsoudlou,

Gasser,

Feldmann

2021

Preprint

View full text Add to dashboard Cite

Internet services leverage transport protocol port numbers to specify the source and destination application layer protocols. While using port 0 is not allowed in most transport protocols, we see a non-negligible share of traffic using port 0 in the Internet. In this study, we dissect port 0 traffic to infer its possible origins and causes using five complementing flow-level and packet-level datasets. We observe 73 GB of port 0 traffic in one week of IXP traffic, most of which we identify as an artifact of packet fragmentation. In our packet-level datasets, most traffic is originated from a small number of hosts and while most of the packets have no payload, a major fraction of packets containing payload belong to the BitTorrent protocol. Moreover, we find unique traffic patterns commonly seen in scanning. In addition to analyzing passive traces, we also conduct an active measurement campaign to study how different networks react to port 0 traffic. We find an unexpectedly high response rate for TCP port 0 probes in IPv4, with very low response rates with other protocol types. Finally, we will be running continuous port 0 measurements and providing the results to the measurement community.

show abstract

Towards Inferring IoT Maliciousness

Bou‐Harb

Neshenko

2020

Cyber Threat Intelligence for the Internet of Things

View full text Add to dashboard Cite

Multidimensional investigation of source port 0 probing

Cited by 27 publications

References 5 publications

DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks

DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks

Zeroing in on Port 0 Traffic in the Wild

Towards Inferring IoT Maliciousness

Contact Info

Product

Resources

About