HoneyLabs

UDP traffic

Datagrams matching asn:198545 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

9

Datagrams

1

Source addresses

1

Networks

1

Countries

6

Destination ports

Traffic by type

Other services

2 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

Latest Redis datagram, to 8082/udp

$.&"R·)jTiC]·@l58WI`·=S· +!·#-·Gd<i6M· !{d·$kD\B <YK·sX;·t^B &&G·\·"}6·a5,· pbc}·<H./!iD·H· n·

payload bytes
00000000  24 2e 26 22 52 11 29 6a  54 69 43 5d 13 40 6c 35  |$.&"R.)jTiC].@l5|
00000010  38 57 49 60 16 3d 53 1a  0d 2b 21 1c 23 2d 16 47  |8WI`.=S..+!.#-.G|
00000020  64 3c 69 36 4d 12 20 21  7b 64 7f 0e 24 6b 44 5c  |d<i6M. !{d..$kD\|
00000030  42 0d 3c 59 4b 10 73 58  3b 14 74 5e 42 0a 26 26  |B.<YK.sX;.t^B.&&|
00000040  47 0f 5c 14 22 7d 36 1d  61 35 2c 05 20 70 62 63  |G.\."}6.a5,. pbc|
00000050  7d 1e 3c 48 2e 2f 21 69  44 15 48 06 20 6e cb 1e  |}.<H./!iD.H. n..|

Unrecognised

7 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Latest Unrecognised datagram, to 11211/udp

5..](S0·d)·wagri{ydj9·

payload bytes
00000000  35 2e 2e 5d 28 53 30 07  00 02 64 29 1d 77 61 67  |5..](S0...d).wag|
00000010  72 69 7b 79 64 6a 39 bf  0f                       |ri{ydj9..|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
Memcached11211/udp3110,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
217.71.127.125AS198545 Flex Network SarlFRUnrecognised92026-10-11 06:11

Latest datagrams