A UDP sender SHOULD NOT use a source port value of zero.  A source
   port number that cannot be easily determined from the address or
   payload type provides protection at the receiver from data injection
   attacks by off-path devices.  A UDP receiver SHOULD NOT bind to port
   zero.

   Applications SHOULD implement receiver port and address checks at the
   application layer or explicitly request that the operating system
   filter the received packets to prevent receiving packets with an
   arbitrary port.  This measure is designed to provide additional
   protection from data injection attacks from an off-path source (where
   the port values may not be known).

   Applications SHOULD provide a check that protects from off-path data
   injection, avoiding an application receiving packets that were
   created by an unauthorized third party.  TCP stacks commonly use a
   randomized source port to provide this protection [RFC6056]; UDP
   applications should follow the same technique.  Middleboxes and end
   systems often make assumptions about the system ports or user ports;
   hence, it is recommended to use randomized ports in the Dynamic and/
   or Private Port range.  Setting a "randomized" source port also
   provides greater assurance that reported ICMP errors originate from
   network systems on the path used by a particular flow.  Some UDP
   applications choose to use a predetermined value for the source port
   (including some multicast applications), these applications need to
   therefore employ a different technique.  Protection from off-path
   data attacks can also be provided by randomizing the initial value of
   another protocol field within the datagram payload, and checking the
   validity of this field at the receiver (e.g., RTP has random initial
   sequence number and random media timestamp offsets [RFC3550]).