论文标题
保留：在端口0上剖析互联网流量0
Reserved: Dissecting Internet Traffic on Port 0
论文作者
论文摘要
运输协议使用端口号允许在Internet主机上进行连接多路复用。 TCP和UDP是两个最广泛的运输协议，对构成有效且无效的端口号的限制有限制。这些协议的无效端口号的一个示例是端口0。在这项工作中，我们提出了分析欧洲大型IXP端口0流量的初步结果。在流量的一周内，我们发现74GB端口0流量。这些流量的绝大多数既有源端口和目标端口设置为0，这表明扫描或侦察是其根本原因。我们的分析还表明，所有端口0流量中有超过一半的目标是18个ASE，而全部流量的一半以上是由大约100个ASES起源的，这表明一组更多样化的来源ASES。
Transport protocols use port numbers to allow connection multiplexing on Internet hosts. TCP as well as UDP, the two most widely used transport protocols, have limitations on what constitutes a valid and invalid port number. One example of an invalid port number for these protocols is port 0. In this work, we present preliminary results from analyzing port 0 traffic at a large European IXP. In one week of traffic we find 74GB port 0 traffic. The vast majority of this traffic has both source and destination ports set to 0, suggesting scanning or reconnaissance as its root cause. Our analysis also shows that more than half of all port 0 traffic is targeted to just 18 ASes, whereas more than half of all traffic is originated by about 100 ASes, suggesting a more diverse set of source ASes.
