UDP traffic

Datagrams matching asn:211298 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

7 datagrams from 7 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 2 Sun RPC 2 SNMP 2 NTP 1

Latest DNS datagram, to 53/udp

DNS query A example.com

payload bytes

00000000  96 3b 01 20 00 01 00 00  00 00 00 00 07 65 78 61  |.;. .........exa|
00000010  6d 70 6c 65 03 63 6f 6d  00 00 01 00 01           |mple.com.....|

Other services

7 datagrams from 7 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 5 RADIUS 1 SIP 1

Latest DTLS datagram, to 12346/udp

·y·y·Jv/·i·$_z·!{·k;V·iK·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 4a 76 2f 16 69  |y.......y..Jv/.i|
00000020  b3 e6 fa f5 ba c1 89 24  5f 7a 06 14 21 7b a2 8c  |.......$_z..!{..|
00000030  6b 3b 56 c7 ec c0 d2 18  69 4b 08 00 00 00 18 c0  |k;V.....iK......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

QUIC

18 datagrams from 18 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 18

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

25 datagrams from 16 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 25

Latest Unrecognised datagram, to 88/udp

j·e0·b· ·U0S·P·NM·0·0·krbtgt·NM·20261011024929Z·X$·0·0·

payload bytes

00000000  6a 81 65 30 81 62 a1 03  02 01 05 a2 03 02 01 0a  |j.e0.b..........|
00000010  a4 81 55 30 53 a0 07 03  05 00 50 00 00 00 a2 04  |..U0S.....P.....|
00000020  1b 02 4e 4d a3 17 30 15  a0 03 02 01 00 a1 0e 30  |..NM..0........0|
00000030  0c 1b 06 6b 72 62 74 67  74 1b 02 4e 4d a5 11 18  |...krbtgt..NM...|
00000040  0f 32 30 32 36 31 30 31  31 30 32 34 39 32 39 5a  |.20261011024929Z|
00000050  a7 06 02 04 58 24 d1 30  a8 0e 30 0c 02 01 12 02  |....X$.0..0.....|
00000060  01 11 02 01 17 02 01 03                           |........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	2	2	28 to 54
SNMPv2	161/udp	2	2	6.3
Portmap	111/udp	1	1	7 to 28
NTP	123/udp	1	1	556.9

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

443/udp QUIC12
8443/udp QUIC6
10001/udp Ubiquiti discovery4
53/udp DNS2
4500/udp IPsec NAT-T2
30770/udp2
10161/udp2
500/udp IKE2
161/udp SNMP2
1194/udp OpenVPN2
1701/udp L2TP2
5060/udp SIP1

DNS questions

example.com A2

DNS record types

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 6 sources6
q13i0307h9_55b375c5d22e_2f871f65fa7d from 3 sources3
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 3 sources3
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 3 sources3
q13i0308h3_55b375c5d22e_bc854dc9d3af from 3 sources3

QUIC transport parameters

60647680e335 from 9 sources9
1f7a23748abd from 6 sources6
4c2cac1ef1cb from 3 sources3

QUIC versions

Networks

AS211298 Driftnet Ltd from 45 sources57

Countries

GB United Kingdom57

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
193.163.125.170	AS211298 Driftnet Ltd	GB	Unrecognised	3	2026-10-10 22:56
193.163.125.151	AS211298 Driftnet Ltd	GB	Unrecognised	3	2026-10-11 03:22
193.163.125.137	AS211298 Driftnet Ltd	GB	Unrecognised	3	2026-10-10 14:10
193.163.125.178	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-10 17:59
193.163.125.237	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-10 12:20
193.163.125.165	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-11 02:40
193.163.125.139	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-10 22:23
193.163.125.161	AS211298 Driftnet Ltd	GB	Sun RPC	2	2026-10-10 11:03
193.163.125.251	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-10 23:02
193.163.125.168	AS211298 Driftnet Ltd	GB	Sun RPC	1	2026-10-10 19:06
185.247.137.167	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 06:01
87.236.176.249	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 11:41
193.163.125.128	AS211298 Driftnet Ltd	GB	Unrecognised	1	2026-10-10 11:12
193.163.125.142	AS211298 Driftnet Ltd	GB	Unrecognised	1	2026-10-11 02:28
193.163.125.173	AS211298 Driftnet Ltd	GB	Unrecognised	1	2026-10-11 02:48
195.96.139.223	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 11:43
193.163.125.153	AS211298 Driftnet Ltd	GB	DTLS	1	2026-10-10 11:43
195.96.139.242	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 11:43
185.247.137.106	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 18:26
193.163.125.118	AS211298 Driftnet Ltd	GB	Unrecognised	1	2026-10-10 09:43

Latest datagrams

2026-10-11 03:22:10193.163.125.151to 12346/udpDTLSGB

·y·y·Jv/·i·$_z·!{·k;V·iK·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 4a 76 2f 16 69  |y.......y..Jv/.i|
00000020  b3 e6 fa f5 ba c1 89 24  5f 7a 06 14 21 7b a2 8c  |.......$_z..!{..|
00000030  6b 3b 56 c7 ec c0 d2 18  69 4b 08 00 00 00 18 c0  |k;V.....iK......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-11 02:48:29193.163.125.173to 88/udpUnrecognisedGB

j·e0·b· ·U0S·P·NM·0·0·krbtgt·NM·20261011024929Z·X$·0·0·

payload bytes

00000000  6a 81 65 30 81 62 a1 03  02 01 05 a2 03 02 01 0a  |j.e0.b..........|
00000010  a4 81 55 30 53 a0 07 03  05 00 50 00 00 00 a2 04  |..U0S.....P.....|
00000020  1b 02 4e 4d a3 17 30 15  a0 03 02 01 00 a1 0e 30  |..NM..0........0|
00000030  0c 1b 06 6b 72 62 74 67  74 1b 02 4e 4d a5 11 18  |...krbtgt..NM...|
00000040  0f 32 30 32 36 31 30 31  31 30 32 34 39 32 39 5a  |.20261011024929Z|
00000050  a7 06 02 04 58 24 d1 30  a8 0e 30 0c 02 01 12 02  |....X$.0..0.....|
00000060  01 11 02 01 17 02 01 03                           |........|

2026-10-11 02:40:02193.163.125.165to 427/udpUnrecognisedGB

·/·en·service:service-agent·

payload bytes

00000000  02 01 00 00 2f 00 00 00  00 00 00 01 00 02 65 6e  |..../.........en|
00000010  00 00 00 15 73 65 72 76  69 63 65 3a 73 65 72 76  |....service:serv|
00000020  69 63 65 2d 61 67 65 6e  74 00 00 00 00 00 00     |ice-agent......|

2026-10-11 02:36:48193.163.125.231to 1967/udpUnrecognisedGB
·
payload bytes
```
00000000  01                                                |.|
```

2026-10-11 02:28:44193.163.125.142to 35253/udpUnrecognisedGB

DB2GETADDR·SQL09010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 39  |DB2GETADDR.SQL09|
00000010  30 31 30 00                                       |010.|

2026-10-11 01:12:42193.163.125.151to 1701/udpUnrecognisedGB

·d· · ·#·l2tpscan·driftnet· ·z· ·

payload bytes

00000000  c8 02 00 64 00 00 00 00  00 00 00 00 80 08 00 00  |...d............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0a  00 00 00 04 00 00 00 03  |................|
00000030  80 08 00 00 00 06 01 23  80 0e 00 00 00 07 6c 32  |.......#......l2|
00000040  74 70 73 63 61 6e 80 0e  00 00 00 08 64 72 69 66  |tpscan......drif|
00000050  74 6e 65 74 80 08 00 00  00 09 b3 7a 80 08 00 00  |tnet.......z....|
00000060  00 0a 00 01                                       |....|

2026-10-10 23:43:21193.163.125.130to 53/udpDNSGB

DNS query A example.com

payload bytes

00000000  96 3b 01 20 00 01 00 00  00 00 00 00 07 65 78 61  |.;. .........exa|
00000010  6d 70 6c 65 03 63 6f 6d  00 00 01 00 01           |mple.com.....|

2026-10-10 23:02:12193.163.125.251to 30770/udpUnrecognisedGB
·
payload bytes
```
00000000  02 08 00 00                                       |....|
```
2026-10-10 23:02:09193.163.125.251to 30770/udpUnrecognisedGB
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```

2026-10-10 22:56:48193.163.125.170to 1167/udpUnrecognisedGB

·uA0·

payload bytes

00000000  02 00 00 00 00 00 00 01  00 00 00 14 ee 75 41 30  |.............uA0|
00000010  00 00 00 00                                       |....|

2026-10-10 22:23:13193.163.125.139to 10001/udpUnrecognisedGB
·
payload bytes
```
00000000  02 08 00 00                                       |....|
```
2026-10-10 22:23:10193.163.125.139to 10001/udpUnrecognisedGB
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```
2026-10-10 21:29:19193.163.125.165to 1194/udpUnrecognisedGB
8·{·
payload bytes
```
00000000  38 1a f4 7b 9c 91 c0 05  99 00 00 00 00 00        |8..{..........|
```

2026-10-10 19:06:33193.163.125.168to 2049/udpSun RPCGB

C·qn·

payload bytes

00000000  43 ec 71 6e 00 00 00 00  00 00 00 02 00 01 86 a0  |C.qn............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 18:26:20185.247.137.106to 443/udpQUICGB
QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co