matthew zeier wrote: > I keep seeing stuff with a udp src or dst port of 0. Anyone else see > that in the wild? If you're getting that from netflow, it's probably IP fragments.