ACL Logging UDP Port 0

Hi All

Need some advice/help/pointers?

I have an access-list as follows:

access-list 101 permit udp any 10.0.0.0 0.0.0.255 range 0 1023 log
access-list 101 permit udp any 172.16.0.0 0.0.255.255 range 0 1023 log

The ip ranges are bogus but this illustrates how my ACLs are configured.

My ACL will log traffic matches like this:

permitted udp 10.0.0.1(0) -> 10.0.0.2(0), 1 packet
permitted udp 172.16.0.18(0) -> 172.16.0.2(0), 1 packet

so UDP port 0 is showing up hwoever it also matches traffic for other
ports aswell:

permitted udp 10.0.0.3(6007) -> 10.0.0.4(80), 1 packet
permitted udp 172.16.0.4(8080) -> 172.16.0.5(80), 1 packet

I am fairly sure (not 100%) that the UDP port 0 traffic is not really
port 0 traffic.
I have googled the subject and people mention that this is how IOS
reports matches if the ACL is not matching ports
but as you can see my ACL is. ALso I cannot find this behaviour
mentioned in any Cisco documentation.

Does anyone have experience with this?

Thanks

Muzammil

Blogs and organic groups at http://www.ccie.net
Received on Thu Jun 02 2011 - 13:13:42 ART