[nsp] PIX

[Niels Bakker]

* chrismcc@pricegrabber.com (Christopher McCrory) [Mon 09 Sep 2002, 16:47 CEST]:
> odusseus wrote:
>> From the firewall's log (Cisco Pix 515), I got 22,000 messages from the
>> same source IP address to the same IP destination saying that: "invalid
>> transport number, in which [...] destination port number for a protocol
>> is zero."
> My money is on this being a probe.  IIRC firewalk, 
> http://www.packetfactory.net/Projects/Firewalk, uses port 0 by default.

That'd be <URL:http://www.packetfactory.net/firewalk/>.

More likely it's hping2 <URL:http://www.hping.org/>, though (I know for
certain that it defaults to port 0 :).


	-- Niels.

--