For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ukhan20's avatar
ukhan20
Icon for Cirrus rankCirrus
Jan 20, 2025

malformed tcp and udp with 0 port

hi , how to stop malformed tcp and udp with 0 port attack in AFM.   does this Irule work   when CLIENT_DATA { if {[UDP::local_port] == 0 || [UDP::remote_port] == 0} { log local0. "Dropped UDP p...
application delivery
security
whisperer's avatar
whisperer
Icon for MVP rankMVP
Jan 21, 2025

How are your virtual servers configured? If you are only listening on specific ports, ie tcp/80, upd/514, etc. then port 0 would not match on the local_port clientside. However, things would be potentially different if you are using wildcard virtual servers that can match multiple ports.

Check out also the following on narrowing the match on any F5 Virtual Server: Three Ways to Specify Multiple Ports on a Virtual Server | DevCentral. You could use things like a port list.

Finally, if the F5 BIG-IP is behind a firewall, wouldnt that take care of a malformed connection?