Access-list logs show TCP port 0 / UDP port 0

[Eric Agana]

Guys.

We have an MPLS point to point connection.

Access-list logs keep on showing traffic to/from tcp or udp port 0. 

I tried to run packet capture on the interface but did not find any traffic related to port 0.

I doubt it is an attack since devices are just point to point.

Anybody who have experienced the same or can share a good documentation about this.

Sample:

*Mar 7 13:42:08.457: %SEC-6-IPACCESSLOGP: list pcap-traffic permitted tcp 10.X.X.X(0) (FastEthernet4 xxxx.xxxx.xxxx) -> 192.X.X.X (0), 134 packets

[Jaderson Pessoa · Accepted solution]

Hello,

The logging facility might drop some logging message packets if there are too many to be handled or if there is more than one logging message to be handled in 1 second. This behavior prevents the router from crashing due to too many logging packets.

When access lists are configured with the log-input keyword, tcp/udp ports are only displayed when the processing of the access lists requires the port number to be extracted for comparison. If the port is not required, the log messages will display 0 as the port number. The log is expected to report the port number if and only if a port number is mentioned in the ACL.

check it for more information: https://community.cisco.com/t5/other-network-architecture/quot-log-quot-word-on-acl-only-producing-port-0/td-p/577024

[Eric Agana]

Thank you very much, Jaderson.

I can see now the specific ports in the ACL sessions.

[Jaderson Pessoa]

Great,

good lucky

[TimothyHenderson4285 · Accepted solution]

I had this same problem:

So if you have and ACL:

10 permit tcp host 1.1.1.1 host 2.2.2.2

It will not show the ports, you must have at least 1 port match to check for ports:

20 permit tcp host 1.1.1.1 host 2.2.2.2 eq 22
After this ^ you will start seeing the ports in the logs.