Hi Nikolaos, The destination "port" numbers are not ports, in case of ICMP. They are the imp type.code, values 3.10 in your case it is destination unreachable (administratively prohibited).
,Peter > On 21 Oct 2016, at 20.16, Nikolaos Milas <[email protected]> wrote: > > Hello, > > I am recording a number of flows of the form: > > Date first seen Event XEvent Proto Src IP > Addr:Port Dst IP Addr:Port X-Src IP Addr:Port X-Dst IP > Addr:Port In Byte Out Byte > 2016-10-21 20:58:51.700 INVALID Ignore ICMP 194.177.194.192:0 > -> 183.7.119.26:3.10 0.0.0.0:0 -> 0.0.0.0:0 > 68 0 > > What is the meaning of these flows please? > > Why source port is 0 and destination port 3.10? > > I cannot understand. > > Please help. > > Thanks, > Nick > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, SlashDot.org! http://sdm.link/slashdot > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
