Proxy seems to be responding to UDP port scanner even though it is not listening to the UDP port.

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

There is a UDP port scanner running against the proxy like Qualys.

The proxy is not listening to the UDP port being scanned, however,r based on the packet capture, the proxy seems to be responding to the UDP port scanner.

The packet capture taken on the proxy shows that the proxy responded with the ICMP's "Destination unreachable (port unreachable)" message.

On the proxy, the advanced URL "/TCP/UDPConnections" output further verifies that the proxy is not listening to the UDP port.

Resolution

This is by design or an expected behavior on the proxy.

Even though the proxy is not listening to the UDP port that the scanner is scanning, due to the ICMP protocol, it had to respond with the "Destination unreachable (port unreachable)" message. Furthermore, the ICMP message itself clearly indicates that the proxy is not listening to the UDP port.