What is TCP port 0 used for? I've searched around and can find nothing that makes sense to me aside from a programmer trick that I don't understand (I'm not a programmer). Inour MARS appliance, it shows up as TCP SYN Host sweep On Same Dest Port. The source addresses are ours, there are a lot of them. Source port varies, but destination is TCP port 0 on a wide variety of destinations. Timing varies, some are spread out, others are within the same second. The IPS signature triggered is NR-3030/0. I put wireshark out there looking for TCP port 0, I don't see anything. Anybody seen this before?