To prevent anyone from bypassing your company's firewall in this way, you can create a packet filter. Ephemeral ports are ports that are temporary. As you might guess, ephemeral ports are used only for a short period of time. For example, when an FTP client issues an ls command to view the contents of a directory, this FTP client sets up a temporary port number to be used for the transfer of directory contents. The FTP client software then translates the ls command to the NLST command.
Ephemeral ports irritate most protocol analysts.
After all, just when you think you have set up a nice FTP filter by using the checkbox method, you find out that the filter won't capture even half of the actual FTP communications. Destination Unreachables Hackers can use ICMP packets to discover information about active devices on your company's network. Any decent network analyzer should have a predefined ICMP filter. However, a predefined filter does not look for specific types of ICMP traffic. The value 0x03 in the ICMP header's Type field identifies the packet as a Destination Unreachable packet.