diff --git a/firewall/interception/ebpf/bpf_bpfeb.o b/firewall/interception/ebpf/bpf_bpfeb.o
index a2bc593d..93a2bb8f 100644
Binary files a/firewall/interception/ebpf/bpf_bpfeb.o and b/firewall/interception/ebpf/bpf_bpfeb.o differ
diff --git a/firewall/interception/ebpf/bpf_bpfel.o b/firewall/interception/ebpf/bpf_bpfel.o
index 1d5d5449..f5396ab0 100644
Binary files a/firewall/interception/ebpf/bpf_bpfel.o and b/firewall/interception/ebpf/bpf_bpfel.o differ
diff --git a/firewall/interception/ebpf/program/monitor.c b/firewall/interception/ebpf/program/monitor.c
index 66177495..9ba6a309 100644
--- a/firewall/interception/ebpf/program/monitor.c
+++ b/firewall/interception/ebpf/program/monitor.c
@@ -90,6 +90,11 @@ int BPF_PROG(udp_v4_connect, struct sock *sk) {
 		return 0;
 	}
 
+	// ip4_datagram_connect return error
+	if (sk->__sk_common.skc_dport == 0) {
+		return 0;
+	}
+
   // Allocate space for the event.
 	struct Event *udp_info;
 	udp_info = bpf_ringbuf_reserve(&events, sizeof(struct Event), 0);
@@ -128,6 +133,11 @@ int BPF_PROG(udp_v6_connect, struct sock *sk) {
 		return 0;
 	}
 
+	// ip6_datagram_connect return error
+	if (sk->__sk_common.skc_dport == 0) {
+		return 0;
+	}
+
   // Make sure its udp6 socket
 	struct udp6_sock *us = bpf_skc_to_udp6_sock(sk);
 	if (!us) {