UDP traffic

Datagrams matching asn:211298 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

319

Datagrams

174

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

64 datagrams from 40 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 16 Sun RPC 15 SOAP 10 NTP 8 DNS 8 SSDP 5 TFTP 2

Latest SNMP datagram, to 161/udp

0>·0· g·0·0·N·0·

payload bytes

00000000  30 3e 02 01 03 30 11 02  04 09 67 89 95 02 03 00  |0>...0....g.....|
00000010  ff e3 04 01 04 02 01 03  04 10 30 0e 04 00 02 01  |..........0.....|
00000020  00 02 01 00 04 00 04 00  04 00 30 14 04 00 04 00  |..........0.....|
00000030  a0 0e 02 04 4e bd b1 f1  02 01 00 02 01 00 30 00  |....N.........0.|

Other services

47 datagrams from 36 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 32 SIP 10 XDMCP 2 RADIUS 2 RTP 1

Latest DTLS datagram, to 443/udp

·y·y·_·3·h+ ·3k*ܵ·)u·:Lb·{T·%ʃ·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 5f 07 f5 ef 33  |y.......y.._...3|
00000020  0e 68 2b 09 d4 33 6b 2a  dc b5 e8 d6 0f 29 75 86  |.h+..3k*.....)u.|
00000030  3a 4c 62 d8 d6 7b 54 8e  25 ca 83 00 00 00 18 c0  |:Lb..{T.%.......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

QUIC

94 datagrams from 85 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 94

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

114 datagrams from 60 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 114

Latest Unrecognised datagram, to 37700/udp

8f·6CK·y·

payload bytes

00000000  38 66 01 36 43 4b 81 af  79 00 00 00 00 00        |8f.6CK..y.....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	16	15	6.3
DNS	53/udp	8	8	28 to 54
NTP	123/udp	8	7	556.9
Portmap	111/udp	6	6	7 to 28
WS-Discovery	3702/udp	8	3	10 to 500
SSDP	1900/udp +1	5	3	30.8
TFTP	19876/udp +1	2	2	60

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

443/udp QUIC56
8443/udp QUIC46
161/udp SNMP16
4500/udp IPsec NAT-T14
500/udp IKE14
10001/udp Ubiquiti discovery13
53/udp DNS8
123/udp NTP8
10443/udp DTLS8
1701/udp L2TP8
2049/udp Sun RPC8
5060/udp SIP8

DNS questions

example.com A8

DNS record types

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 31 sources32
q13i0307h9_55b375c5d22e_2f871f65fa7d from 16 sources16
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 16 sources16
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 15 sources15
q13i0308h3_55b375c5d22e_bc854dc9d3af from 15 sources15

QUIC transport parameters

60647680e335 from 44 sources47
1f7a23748abd from 31 sources32
4c2cac1ef1cb from 15 sources15

QUIC versions

Networks

AS211298 Driftnet Ltd from 174 sources319

Countries

GB United Kingdom319

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
193.163.125.139	AS211298 Driftnet Ltd	GB	Unrecognised	6	2026-10-10 22:23
193.163.125.178	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-10 17:59
193.163.125.170	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-10 22:56
193.163.125.166	AS211298 Driftnet Ltd	GB	SOAP	5	2026-10-11 08:43
193.163.125.151	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-11 05:37
193.163.125.116	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-09 03:09
193.163.125.241	AS211298 Driftnet Ltd	GB	SOAP	5	2026-10-08 22:52
193.163.125.173	AS211298 Driftnet Ltd	GB	SNMP	5	2026-10-11 02:48
193.163.125.167	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-11 06:50
193.163.125.130	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-10 23:43
193.163.125.179	AS211298 Driftnet Ltd	GB	SNMP	4	2026-10-11 08:43
193.163.125.175	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-08 09:32
193.163.125.137	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-10 14:10
193.163.125.231	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-11 02:36
193.163.125.150	AS211298 Driftnet Ltd	GB	TFTP	4	2026-10-09 10:35
193.163.125.165	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-11 02:40
193.163.125.153	AS211298 Driftnet Ltd	GB	SOAP	4	2026-10-10 11:43
193.163.125.143	AS211298 Driftnet Ltd	GB	Unrecognised	3	2026-10-07 22:02
193.163.125.234	AS211298 Driftnet Ltd	GB	Unrecognised	3	2026-10-07 13:46
193.163.125.219	AS211298 Driftnet Ltd	GB	Unrecognised	3	2026-10-07 11:59

Latest datagrams

2026-10-11 08:43:18193.163.125.179to 161/udpSNMPGB

0>·0· g·0·0·N·0·

payload bytes

00000000  30 3e 02 01 03 30 11 02  04 09 67 89 95 02 03 00  |0>...0....g.....|
00000010  ff e3 04 01 04 02 01 03  04 10 30 0e 04 00 02 01  |..........0.....|
00000020  00 02 01 00 04 00 04 00  04 00 30 14 04 00 04 00  |..........0.....|
00000030  a0 0e 02 04 4e bd b1 f1  02 01 00 02 01 00 30 00  |....N.........0.|

2026-10-11 08:43:15193.163.125.166to 161/udpSNMPGB

0)·public·*·8P·0·0·+·

payload bytes

00000000  30 29 02 01 01 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 2a eb 38 50 02 01 00  02 01 00 30 0e 30 0c 06  |.*.8P......0.0..|
00000020  08 2b 06 01 02 01 01 05  00 05 00                 |.+.........|

2026-10-11 07:37:07193.163.125.148to 37700/udpUnrecognisedGB
8f·6CK·y·
payload bytes
```
00000000  38 66 01 36 43 4b 81 af  79 00 00 00 00 00        |8f.6CK..y.....|
```

2026-10-11 07:29:22193.163.125.253to 443/udpDTLSGB

·y·y·_·3·h+ ·3k*ܵ·)u·:Lb·{T·%ʃ·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 5f 07 f5 ef 33  |y.......y.._...3|
00000020  0e 68 2b 09 d4 33 6b 2a  dc b5 e8 d6 0f 29 75 86  |.h+..3k*.....)u.|
00000030  3a 4c 62 d8 d6 7b 54 8e  25 ca 83 00 00 00 18 c0  |:Lb..{T.%.......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-11 06:50:32193.163.125.167to 3283/udpUnrecognisedGB
·
payload bytes
```
00000000  00 14 00 01 03                                    |.....|
```

2026-10-11 05:37:27193.163.125.151to 500/udpUnrecognisedGB

J·#S·w·! "·D"·,· · ·

payload bytes

00000000  4a ed 23 53 c3 77 ec a6  00 00 00 00 00 00 00 00  |J.#S.w..........|
00000010  21 20 22 08 00 00 00 00  00 00 02 44 22 00 01 a8  |! "........D"...|
00000020  02 00 00 2c 01 01 00 04  03 00 00 0c 01 00 00 0c  |...,............|
00000030  80 0e 01 00 03 00 00 08  02 00 00 06 03 00 00 08  |................|
00000040  03 00 00 0d 00 00 00 08  04 00 00 14 02 00 00 f0  |................|
00000050  02 01 00 1c 03 00 00 08  01 00 00 02 03 00 00 08  |................|
00000060  01 00 00 03 03 00 00 08  01 00 00 04 03 00 00 08  |................|
00000070  01 00 00 06 03 00 00 08  01 00 00 07 03 00 00 08  |................|
00000080  01 00 00 08 03 00 00 08  01 00 00 0b 03 00 00 0c  |................|
00000090  01 00 00 0c 80 0e 00 80  03 00 00 0c 01 00 00 0c  |................|
000000a0  80 0e 01 00 03 00 00 08  01 00 00 0d 03 00 00 08  |................|
000000b0  02 00 00 01 03 00 00 08  02 00 00 02 03 00 00 08  |................|
000000c0  02 00 00 05 03 00 00 08  02 00 00 06 03 00 00 08  |................|
000000d0  02 00 00 07 03 00 00 08  03 00 00 00 03 00 00 08  |................|
000000e0  03 00 00 01 03 00 00 08  03 00 00 02 03 00 00 08  |................|
000000f0  03 00 00 0c 03 00 00 08  03 00 00 0d 03 00 00 08  |................|
... 512 bytes shown in part

2026-10-11 03:22:10193.163.125.151to 12346/udpDTLSGB

·y·y·Jv/·i·$_z·!{·k;V·iK·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 4a 76 2f 16 69  |y.......y..Jv/.i|
00000020  b3 e6 fa f5 ba c1 89 24  5f 7a 06 14 21 7b a2 8c  |.......$_z..!{..|
00000030  6b 3b 56 c7 ec c0 d2 18  69 4b 08 00 00 00 18 c0  |k;V.....iK......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-11 02:48:29193.163.125.173to 88/udpUnrecognisedGB

j·e0·b· ·U0S·P·NM·0·0·krbtgt·NM·20261011024929Z·X$·0·0·

payload bytes

00000000  6a 81 65 30 81 62 a1 03  02 01 05 a2 03 02 01 0a  |j.e0.b..........|
00000010  a4 81 55 30 53 a0 07 03  05 00 50 00 00 00 a2 04  |..U0S.....P.....|
00000020  1b 02 4e 4d a3 17 30 15  a0 03 02 01 00 a1 0e 30  |..NM..0........0|
00000030  0c 1b 06 6b 72 62 74 67  74 1b 02 4e 4d a5 11 18  |...krbtgt..NM...|
00000040  0f 32 30 32 36 31 30 31  31 30 32 34 39 32 39 5a  |.20261011024929Z|
00000050  a7 06 02 04 58 24 d1 30  a8 0e 30 0c 02 01 12 02  |....X$.0..0.....|
00000060  01 11 02 01 17 02 01 03                           |........|

2026-10-11 02:40:02193.163.125.165to 427/udpUnrecognisedGB

·/·en·service:service-agent·

payload bytes

00000000  02 01 00 00 2f 00 00 00  00 00 00 01 00 02 65 6e  |..../.........en|
00000010  00 00 00 15 73 65 72 76  69 63 65 3a 73 65 72 76  |....service:serv|
00000020  69 63 65 2d 61 67 65 6e  74 00 00 00 00 00 00     |ice-agent......|

2026-10-11 02:36:48193.163.125.231to 1967/udpUnrecognisedGB
·
payload bytes
```
00000000  01                                                |.|
```

2026-10-11 02:28:44193.163.125.142to 35253/udpUnrecognisedGB

DB2GETADDR·SQL09010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 39  |DB2GETADDR.SQL09|
00000010  30 31 30 00                                       |010.|

2026-10-11 01:12:42193.163.125.151to 1701/udpUnrecognisedGB

·d· · ·#·l2tpscan·driftnet· ·z· ·

payload bytes

00000000  c8 02 00 64 00 00 00 00  00 00 00 00 80 08 00 00  |...d............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0a  00 00 00 04 00 00 00 03  |................|
00000030  80 08 00 00 00 06 01 23  80 0e 00 00 00 07 6c 32  |.......#......l2|
00000040  74 70 73 63 61 6e 80 0e  00 00 00 08 64 72 69 66  |tpscan......drif|
00000050  74 6e 65 74 80 08 00 00  00 09 b3 7a 80 08 00 00  |tnet.......z....|
00000060  00 0a 00 01                                       |....|

2026-10-10 23:43:21193.163.125.130to 53/udpDNSGB

DNS query A example.com

payload bytes

00000000  96 3b 01 20 00 01 00 00  00 00 00 00 07 65 78 61  |.;. .........exa|
00000010  6d 70 6c 65 03 63 6f 6d  00 00 01 00 01           |mple.com.....|

2026-10-10 23:02:12193.163.125.251to 30770/udpUnrecognisedGB
·
payload bytes
```
00000000  02 08 00 00                                       |....|
```
2026-10-10 23:02:09193.163.125.251to 30770/udpUnrecognisedGB
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```