Forum Discussion

ukhan20's avatar
ukhan20
Icon for Altocumulus rankAltocumulus
Jan 20, 2025

malformed tcp and udp with 0 port

hi , how to stop malformed tcp and udp with 0 port attack in AFM.   does this Irule work   when CLIENT_DATA { if {[UDP::local_port] == 0 || [UDP::remote_port] == 0} { log local0. "Dropped UDP p...
application delivery
security
whisperer's avatar
whisperer
Icon for MVP rankMVP
Jan 21, 2025

How are your virtual servers configured? If you are only listening on specific ports, ie tcp/80, upd/514, etc. then port 0 would not match on the local_port clientside. However, things would be potentially different if you are using wildcard virtual servers that can match multiple ports.

Check out also the following on narrowing the match on any F5 Virtual Server: Three Ways to Specify Multiple Ports on a Virtual Server | DevCentral. You could use things like a port list.

Finally, if the F5 BIG-IP is behind a firewall, wouldnt that take care of a malformed connection?