HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching asn:6939 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

1.1K

Datagrams

590

Source addresses

1

Networks

1

Countries

52

Destination ports

Traffic by type

Service queries

272 datagrams from 233 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 46 CoAP 41 NTP 37 NetBIOS 23 TFTP 23 Sun RPC 23 SNMP 21 CLDAP 20 Memcached 19 SSDP 19

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes
00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Other services

264 datagrams from 204 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 143 XDMCP 23 GTP-U 23 GTP-C 23 RTP 21 STUN 19 TEREDO 12

Latest DTLS datagram, to 13046/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes
00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

612 datagrams from 400 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 612

Latest Unrecognised datagram, to 3389/udp

·

payload bytes
00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
Memcached11211/udp +1413810,000 to 51,000
NTP123/udp3736556.9
DNS53/udp +1252328 to 54
Portmap111/udp23227 to 28
NetBIOS137/udp23223.8
TFTP69/udp232260
QOTD17/udp2222140.3
mDNS5353/udp21212 to 10
SNMPv2161/udp21206.3
CLDAP389/udp202056 to 70
WS-Discovery3702/udp202010 to 500
CharGEN19/udp2019358.8
SSDP1900/udp191930.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

DNS questions

DNS record types

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
216.218.142.110AS6939 Hurricane Electric LLCUSTEREDO122026-10-07 20:34
65.49.1.63AS6939 Hurricane Electric LLCUSUnrecognised72026-10-10 07:30
64.62.156.73AS6939 Hurricane Electric LLCUSUnrecognised72026-10-10 08:31
64.62.156.22AS6939 Hurricane Electric LLCUSGTP-C62026-10-10 08:01
65.49.1.10AS6939 Hurricane Electric LLCUSUnrecognised62026-10-10 06:38
65.49.1.70AS6939 Hurricane Electric LLCUSUnrecognised62026-10-11 02:37
65.49.1.72AS6939 Hurricane Electric LLCUSUnrecognised62026-10-10 08:39
64.62.156.17AS6939 Hurricane Electric LLCUSUnrecognised62026-10-11 02:42
64.62.156.53AS6939 Hurricane Electric LLCUSUnrecognised62026-10-11 03:04
64.62.156.72AS6939 Hurricane Electric LLCUSUnrecognised62026-10-10 06:14
184.105.247.247AS6939 Hurricane Electric LLCUSUnrecognised62026-10-10 02:47
65.49.1.117AS6939 Hurricane Electric LLCUSUnrecognised62026-10-11 01:28
65.49.1.36AS6939 Hurricane Electric LLCUSGTP-C62026-10-11 02:39
65.49.1.54AS6939 Hurricane Electric LLCUSSNMP62026-10-11 02:32
64.62.156.78AS6939 Hurricane Electric LLCUSDNS52026-10-09 03:48
65.49.1.208AS6939 Hurricane Electric LLCUSDTLS52026-10-08 08:16
64.62.197.194AS6939 Hurricane Electric LLCUSUnrecognised52026-10-09 08:04
65.49.1.118AS6939 Hurricane Electric LLCUSGTP-U52026-10-10 06:32
65.49.1.52AS6939 Hurricane Electric LLCUSUnrecognised52026-10-11 03:53
65.49.1.62AS6939 Hurricane Electric LLCUSUnrecognised52026-10-10 08:48

Latest datagrams