UDP traffic

Datagrams matching asn:6939 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

213

Datagrams

187

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

46 datagrams from 43 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 9 NTP 8 Sun RPC 7 TFTP 6 SSDP 4 NetBIOS 3 CLDAP 3 Memcached 2 CoAP 2 SNMP 2

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Other services

46 datagrams from 46 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 23 XDMCP 5 GTP-U 5 GTP-C 5 STUN 4 RTP 4

Latest DTLS datagram, to 13046/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

121 datagrams from 112 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 121

Latest Unrecognised datagram, to 32414/udp

payload bytes

00000000  4d                                                |M|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NTP	123/udp	8	8	556.9
Memcached	11211/udp +1	7	7	10,000 to 51,000
Portmap	111/udp	7	6	7 to 28
TFTP	69/udp	6	5	60
DNS	53/udp	5	5	28 to 54
QOTD	17/udp	5	5	140.3
mDNS	5353/udp	4	4	2 to 10
SSDP	1900/udp	4	4	30.8
NetBIOS	137/udp	3	3	3.8
CLDAP	389/udp	3	3	56 to 70
CharGEN	19/udp	3	3	358.8
WS-Discovery	3702/udp	3	3	10 to 500
SNMPv2	161/udp	2	2	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

2123/udp GTP-C9
500/udp IKE9
123/udp NTP8
34980/udp7
111/udp Sun RPC7
10001/udp Ubiquiti discovery7
69/udp TFTP6
7/udp6
32414/udp5
17/udp QOTD5
12646/udp DTLS5
12546/udp DTLS5

DNS questions

DNS record types

A5
PTR4

Networks

AS6939 Hurricane Electric LLC from 187 sources213

Countries

US United States213

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
64.62.156.32	AS6939 Hurricane Electric LLC	US	GTP-C	4	2026-10-11 04:22
65.49.1.117	AS6939 Hurricane Electric LLC	US	Unrecognised	3	2026-10-11 01:28
64.62.197.88	AS6939 Hurricane Electric LLC	US	TFTP	3	2026-10-10 08:10
64.62.197.39	AS6939 Hurricane Electric LLC	US	DNS	2	2026-10-11 02:14
65.49.1.70	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-11 04:24
65.49.1.85	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-10 14:48
64.62.156.161	AS6939 Hurricane Electric LLC	US	DTLS	2	2026-10-11 03:31
64.62.197.140	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-11 03:29
184.105.247.243	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-11 02:56
65.49.1.89	AS6939 Hurricane Electric LLC	US	Sun RPC	2	2026-10-11 01:14
184.105.247.235	AS6939 Hurricane Electric LLC	US	DNS	2	2026-10-11 02:02
64.62.156.80	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-10 07:53
65.49.1.210	AS6939 Hurricane Electric LLC	US	SSDP	2	2026-10-11 02:02
65.49.20.106	AS6939 Hurricane Electric LLC	US	NTP	2	2026-10-11 01:36
65.49.1.36	AS6939 Hurricane Electric LLC	US	NetBIOS	2	2026-10-11 02:39
64.62.197.112	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-10 07:11
64.62.156.10	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-11 03:52
64.62.197.121	AS6939 Hurricane Electric LLC	US	XDMCP	2	2026-10-11 02:14
64.62.156.83	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-11 00:34
64.62.156.129	AS6939 Hurricane Electric LLC	US	Unrecognised	2	2026-10-11 03:33

Latest datagrams

2026-10-11 04:29:58184.105.139.79to 32414/udpUnrecognisedUS
M
payload bytes
```
00000000  4d                                                |M|
```

2026-10-11 04:24:4465.49.1.70to 3478/udpSTUNUS

·!·B·

payload bytes

00000000  00 01 00 00 21 12 a4 42  00 00 00 00 00 00 00 00  |....!..B........|
00000010  00 00 00 00                                       |....|

2026-10-11 04:22:4564.62.197.68to 34980/udpUnrecognisedUS

·0·

payload bytes

00000000  0e 10 07 02 00 00 30 01  02 00 00 00 00 00 00 00  |......0.........|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00        |..............|

2026-10-11 04:22:3264.62.197.203to 5351/udpUnrecognisedUS
·
payload bytes
```
00000000  00 00                                             |..|
```

2026-10-11 04:22:2265.49.1.78to 3478/udpSTUNUS

·!·B·

payload bytes

00000000  00 01 00 00 21 12 a4 42  00 00 00 00 00 00 00 00  |....!..B........|
00000010  00 00 00 00                                       |....|

2026-10-11 04:22:0064.62.156.32to 10001/udpUnrecognisedUS
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```

2026-10-11 04:18:1365.49.1.177to 13046/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 04:17:0065.49.20.122to 3389/udpUnrecognisedUS

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:16:1664.62.197.20to 53413/udpUnrecognisedUS
payload bytes
```
00000000  0a                                                |.|
```

2026-10-11 04:13:4064.62.156.50to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-11 04:12:0364.62.156.63to 17/udpUnrecognisedUS
payload bytes
```
00000000  0a                                                |.|
```
2026-10-11 04:10:5265.49.1.29to 3283/udpUnrecognisedUS
·
payload bytes
```
00000000  00 14 00 01 03                                    |.....|
```
2026-10-11 04:04:3664.62.197.222to 1434/udpUnrecognisedUS
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-11 03:59:0064.62.197.46to 10074/udpMemcachedUS
stats
payload bytes
```
00000000  73 74 61 74 73 0a                                 |stats.|
```
2026-10-11 03:53:5965.49.1.52to 1434/udpUnrecognisedUS
·
payload bytes
```
00000000  02                                                |.|
```