在野外对端口0流量进行归零
Zeroing in on Port 0 Traffic in the Wild
摘要：
Internet服务利用传输协议端口号来指定源和目标应用层协议。虽然在大多数传输协议中不允许使用端口0，但我们在Internet中看到使用端口0的流量不可忽略。在这项研究中，我们剖析端口0流量推断其可能的起源和原因，使用五个补充流级和数据包级数据集。我们在一周的IXP流量中观察到73 GB的端口0流量，其中大部分我们认为是数据包碎片的伪影。在我们的数据包级数据集中，大多数流量来自少数主机，虽然大多数数据包没有有效载荷，但包含有效载荷的大部分数据包属于BitTorrent协议。此外，我们还发现了扫描中常见的独特流量模式。除了分析被动跟踪，我们还进行了主动测量活动，以研究不同的网络对端口0流量的反应。我们发现一个意外的高响应率的TCP端口0探测在IPv4中，与其他协议类型的响应率非常低。最后，我们将运行连续的端口0测量，并将结果提供给测量社区。
英文摘要：
Internet services leverage transport protocol port numbers to specify the source and destination application layer protocols. While using port 0 is not allowed in most transport protocols, we see a non-negligible share of traffic using port 0 in the Internet. In this study, we dissect port 0 traffic to infer its possible origins and causes using five complementing flow-level and packet-level datasets. We observe 73 GB of port 0 traffic in one week of IXP traffic, most of which we identify as an artifact of packet fragmentation. In our packet-level datasets, most traffic is originated from a small number of hosts and while most of the packets have no payload, a major fraction of packets containing payload belong to the BitTorrent protocol. Moreover, we find unique traffic patterns commonly seen in scanning. In addition to analyzing passive traces, we also conduct an active measurement campaign to study how different networks react to port 0 traffic. We find an unexpectedly high response rate for TCP port 0 probes in IPv4, with very low response rates with other protocol types. Finally, we will be running continuous port 0 measurements and providing the results to the measurement community.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
