UDP traffic

Datagrams matching country:CN sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

472

Datagrams

147

Source addresses

Networks

Countries

152

Destination ports

Traffic by type

Service queries

32 datagrams from 16 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

CoAP 9 DNS 8 SNMP 7 NTP 6 TFTP 1 SOAP 1

Latest CoAP datagram, to 5683/udp

@·λ.well-known·core

payload bytes

00000000  40 01 01 ce bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

Other services

21 datagrams from 18 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 10 SIP 7 XDMCP 1 GTP-U 1 RADIUS 1 OOKLA 1

Latest SOCKS5 datagram, to 22140/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

393 datagrams from 116 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 393

Latest Unrecognised datagram, to 8000/udp

q.·mZA+·,xzjuA7·NnWm·s·~Y·a·KRc@

payload bytes

00000000  71 2e 1b 6d 5a 41 2b 1f  2c 78 7a 6a 75 41 37 13  |q..mZA+.,xzjuA7.|
00000010  11 4e 6e 57 6d 1e 73 12  16 7e 59 0b 61 06 4b 52  |.NnWm.s..~Y.a.KR|
00000020  63 40                                             |c@|

Peer-to-peer

26 datagrams from 2 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 26

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	7	6	28 to 54
SNMPv2	161/udp +1	7	4	6.3
NTP	123/udp	6	3	556.9
mDNS	5353/udp	3	3	2 to 10
RIPv1	520/udp	2	2	131.24
TFTP	69/udp	1	1	60
Memcached	11211/udp	1	1	10,000 to 51,000
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

500/udp IKE28
39131/udp BitTorrent26
1701/udp L2TP20
9034/udp11
3294/udp10
27015/udp Steam8
53/udp DNS7
5060/udp SIP7
123/udp NTP6
161/udp SNMP5
8080/udp5
32209/udp4

DNS questions

DNS record types

TXT4
A3
PTR1

Networks

AS37963 Hangzhou Alibaba Advertising Co.,Ltd. from 32 sources233
AS4134 Chinanet from 38 sources74
AS136180 Beijing Tiantexin Tech. Co., Ltd. from 4 sources50
AS4837 CHINA UNICOM China169 Backbone from 41 sources45
AS58466 CHINANET Guangdong province network from 7 sources19
AS140308 CHINATELECOM Guangdong province Zhuhai 5 from 1 source15
AS9808 China Mobile Communications Group Co., L from 6 sources8
AS140345 CHINATELECOM Yunnan province Shengji 5G from 1 source4
AS4811 China Telecom (Group) from 1 source4
AS24151 China Internet Network Infomation Center from 1 source2

Countries

CN China472

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
103.203.57.10	AS136180 Beijing Tiantexin Tech. Co., Ltd.	CN	Unrecognised	20	2026-10-10 23:42
103.203.57.27	AS136180 Beijing Tiantexin Tech. Co., Ltd.	CN	Unrecognised	18	2026-10-11 03:42
218.16.197.7	AS140308 CHINATELECOM Guangdong province Zhuhai 5	CN	BitTorrent	15	2026-10-10 08:53
223.157.171.209	AS4134 Chinanet	CN	BitTorrent	11	2026-10-10 08:52
47.95.202.159	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-08 13:53
121.199.163.131	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-08 07:03
121.41.166.50	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	CoAP	8	2026-10-05 16:18
121.41.165.209	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-09 10:30
121.199.172.2	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-09 12:18
121.43.119.114	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-06 16:26
47.94.165.91	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-08 11:14
121.40.47.206	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-08 12:00
47.94.131.134	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-09 04:56
47.97.199.68	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-07 11:13
121.40.45.152	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-06 12:03
47.95.201.222	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-09 06:50
47.94.136.50	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-08 17:47
121.40.46.218	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-06 17:43
112.124.59.239	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-05 16:42
121.41.167.96	AS37963 Hangzhou Alibaba Advertising Co.,Ltd.	CN	Unrecognised	8	2026-10-05 15:58

Latest datagrams

2026-10-11 03:47:288.147.115.132to 8000/udpUnrecognisedCN

q.·mZA+·,xzjuA7·NnWm·s·~Y·a·KRc@

payload bytes

00000000  71 2e 1b 6d 5a 41 2b 1f  2c 78 7a 6a 75 41 37 13  |q..mZA+.,xzjuA7.|
00000010  11 4e 6e 57 6d 1e 73 12  16 7e 59 0b 61 06 4b 52  |.NnWm.s..~Y.a.KR|
00000020  63 40                                             |c@|

2026-10-11 03:42:20103.203.57.27to 500/udpUnrecognisedCN

·;·`·D·8· · · · ·

payload bytes

00000000  00 00 00 00 85 e9 bd 3b  00 00 00 00 00 00 00 00  |.......;........|
00000010  01 10 02 00 00 00 00 00  00 00 01 60 00 00 01 44  |...........`...D|
00000020  00 00 00 01 00 00 00 01  00 00 01 38 01 01 00 0d  |...........8....|
00000030  03 00 00 20 00 01 00 00  80 01 00 05 80 02 00 02  |... ............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 80 0c 00 01  |................|
00000050  03 00 00 20 00 01 00 00  80 01 00 01 80 02 00 01  |... ............|
00000060  80 03 00 01 80 04 00 02  80 0b 00 01 80 0c 00 01  |................|
00000070  03 00 00 20 00 01 00 00  80 01 00 07 80 02 00 04  |... ............|
00000080  80 03 00 01 80 04 00 0e  80 0b 00 01 80 0c 00 01  |................|
00000090  03 00 00 14 00 01 00 00  80 01 00 05 80 02 00 02  |................|
000000a0  80 03 00 02 03 00 00 14  00 01 00 00 80 01 00 05  |................|
000000b0  80 02 00 02 80 03 00 03  03 00 00 14 00 01 00 00  |................|
000000c0  80 01 00 05 80 02 00 02  80 03 00 04 03 00 00 14  |................|
000000d0  00 01 00 00 80 01 00 05  80 02 00 02 80 03 00 08  |................|
000000e0  03 00 00 14 00 01 00 00  80 01 00 05 80 02 00 02  |................|
000000f0  80 03 fa dd 03 00 00 14  00 01 00 00 80 01 00 05  |................|
... 352 bytes shown in part

2026-10-11 03:30:08182.88.7.101to 5060/udpSIPCN

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/UDP nm;branch=foo;rport Max-Forwards: 70 To: <sip:nm@nm> From: <sip:nm@nm>;tag=root Call-ID: 50000 CSeq: 63104 OPTIONS Contact: <sip:nm@nm> Accept: applicat

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 55 44 50  20 6e 6d 3b 62 72 61 6e  |/2.0/UDP nm;bran|
00000030  63 68 3d 66 6f 6f 3b 72  70 6f 72 74 0d 0a 4d 61  |ch=foo;rport..Ma|
00000040  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000050  54 6f 3a 20 3c 73 69 70  3a 6e 6d 40 6e 6d 3e 0d  |To: <sip:nm@nm>.|
00000060  0a 46 72 6f 6d 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |.From: <sip:nm@n|
00000070  6d 3e 3b 74 61 67 3d 72  6f 6f 74 0d 0a 43 61 6c  |m>;tag=root..Cal|
00000080  6c 2d 49 44 3a 20 35 30  30 30 30 0d 0a 43 53 65  |l-ID: 50000..CSe|
00000090  71 3a 20 36 33 31 30 34  20 4f 50 54 49 4f 4e 53  |q: 63104 OPTIONS|
000000a0  0d 0a 43 6f 6e 74 61 63  74 3a 20 3c 73 69 70 3a  |..Contact: <sip:|
000000b0  6e 6d 40 6e 6d 3e 0d 0a  41 63 63 65 70 74 3a 20  |nm@nm>..Accept: |
000000c0  61 70 70 6c 69 63 61 74  69 6f 6e 2f 73 64 70 0d  |application/sdp.|
000000d0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
000000e0  20 30 0d 0a 0d 0a                                 | 0....|

2026-10-11 03:01:37122.246.8.150to 45348/udpUnrecognisedCN

·5·}·bs/·w·ל·\·i,·h· · ·W·*·q·М·v6·o·SK·a|~r='·ER·u?Vk·D·@·6·

payload bytes

00000000  bf 35 8e e7 e4 7d ff bd  98 62 73 2f fa 86 77 96  |.5...}...bs/..w.|
00000010  e9 d7 9c 97 e2 5c 16 07  69 2c fa 68 a0 df 0a 1c  |.....\..i,.h....|
00000020  f5 b9 09 b4 f7 57 d5 2a  f9 a6 8e 12 a1 71 f4 d0  |.....W.*.....q..|
00000030  9c b8 bd e3 d5 0f d5 db  18 14 07 76 36 ed a7 d0  |...........v6...|
00000040  6f e3 53 4b c4 e9 f2 61  7c 7e 72 3d 27 f6 89 45  |o.SK...a|~r='..E|
00000050  52 fa ff fb d9 0b 75 3f  56 6b 1b b9 c5 44 0c 90  |R.....u?Vk...D..|
00000060  40 c4 36 e4 c2 e4 11 4e  cc 5c 6c 78 29 99 d9 ef  |@.6....N.\lx)...|
00000070  48 8b b9 2e aa 07 bf 10  85 17 39 84 62 a6 de 68  |H.........9.b..h|
00000080  77 f1 59 db e0 99 97 0a  dc 7e 49 84 88 7f 99 fd  |w.Y......~I.....|
00000090  75 bd 36 a8 59 b0 de d2  77 ac 8e 09 03 68 41 70  |u.6.Y...w....hAp|
000000a0  9f fc 3f c3 40 65 24 a0  53 aa 36 63 12 88 9e a7  |..?.@e$.S.6c....|
000000b0  6c f4 b9 12 05 dd d0 08  07 c6 e7 fe 51 ed 3c 07  |l...........Q.<.|
000000c0  98 18 23 01 73 ae fd 9a  43 67 1d 06 7b 52 1c 69  |..#.s...Cg..{R.i|
000000d0  22 0b 38 29 26 4d 53 df  5d b9 f5 3d b6 e3 1b b7  |".8)&MS.]..=....|
000000e0  cd 52 b7 32 81 cd d6 ec  13 4f cb f5 bd df 54 88  |.R.2.....O....T.|
000000f0  e5 6c 8f 26 0a f9 5f d1  67 84 2d 18 20 b8 4e 74  |.l.&.._.g.-. .Nt|
... 512 bytes shown in part

2026-10-11 01:28:51116.30.9.218to 4000/udpUnrecognisedCN

z./D?oT·w7hw-·C·)·>z|·m^_C%-·RNd·=8·Y·

payload bytes

00000000  7a 2e 2f 44 3f 6f 54 01  1b 77 37 68 77 2d 7f 43  |z./D?oT..w7hw-.C|
00000010  13 0b 29 01 3e 7a 7c 12  6d 5e 5f 43 25 2d 1f 1f  |..).>z|.m^_C%-..|
00000020  52 4e 64 11 3d 38 12 59  ab 8d                    |RNd.=8.Y..|

2026-10-10 23:42:18103.203.57.10to 1701/udpUnrecognisedCN

·<·masscan1· · ·

payload bytes

00000000  c8 02 00 3c 00 00 00 00  00 00 00 00 80 08 00 00  |...<............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0e 00 00  |................|
00000020  00 07 6d 61 73 73 63 61  6e 31 80 0a 00 00 00 03  |..masscan1......|
00000030  00 00 00 03 80 08 00 00  00 09 00 00              |............|

2026-10-10 22:27:28123.144.21.9to 520/udpUnrecognisedCN

·D·

payload bytes

00000000  01 01 00 00 00 02 00 00  44 00 00 00 00 00 00 00  |........D.......|
00000010  00 00 00 00 00 00 00 0f                           |........|

2026-10-10 21:24:26183.129.148.70to 8081/udpUnrecognisedCN
·.MkR·&GG·k
payload bytes
```
00000000  0f 2e 4d 6b 52 05 26 47  47 8d 6b                 |..MkR.&GG.k|
```
2026-10-10 21:17:54106.75.176.152to 5554/udpUnrecognisedCN
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```

2026-10-10 19:01:41124.31.106.10to 5061/udpSIPCN

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/UDP nm;branch=foo;rport Max-Forwards: 70 To: <sip:nm@nm> From: <sip:nm@nm>;tag=root Call-ID: 50000 CSeq: 63104 OPTIONS Contact: <sip:nm@nm> Accept: applicat

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 55 44 50  20 6e 6d 3b 62 72 61 6e  |/2.0/UDP nm;bran|
00000030  63 68 3d 66 6f 6f 3b 72  70 6f 72 74 0d 0a 4d 61  |ch=foo;rport..Ma|
00000040  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000050  54 6f 3a 20 3c 73 69 70  3a 6e 6d 40 6e 6d 3e 0d  |To: <sip:nm@nm>.|
00000060  0a 46 72 6f 6d 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |.From: <sip:nm@n|
00000070  6d 3e 3b 74 61 67 3d 72  6f 6f 74 0d 0a 43 61 6c  |m>;tag=root..Cal|
00000080  6c 2d 49 44 3a 20 35 30  30 30 30 0d 0a 43 53 65  |l-ID: 50000..CSe|
00000090  71 3a 20 36 33 31 30 34  20 4f 50 54 49 4f 4e 53  |q: 63104 OPTIONS|
000000a0  0d 0a 43 6f 6e 74 61 63  74 3a 20 3c 73 69 70 3a  |..Contact: <sip:|
000000b0  6e 6d 40 6e 6d 3e 0d 0a  41 63 63 65 70 74 3a 20  |nm@nm>..Accept: |
000000c0  61 70 70 6c 69 63 61 74  69 6f 6e 2f 73 64 70 0d  |application/sdp.|
000000d0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
000000e0  20 30 0d 0a 0d 0a                                 | 0....|

2026-10-10 18:33:37122.246.8.150to 30214/udpUnrecognisedCN

·F· ·@·e!"E ·T·o· 6·=·k·v_·xx·#5·^·(}·it·e·أHQ·, ŀ"·Y·Ӄ·W·v=·P&·%d· ·m·P]·91^·H·*· b.}

payload bytes

00000000  e2 46 f5 c1 0d 92 d4 d4  c1 40 99 65 21 22 45 0d  |.F.......@.e!"E.|
00000010  f4 1f 54 15 6f b0 0a 36  aa fe 3d 14 99 c7 0f 6b  |..T.o..6..=....k|
00000020  97 76 5f ba 78 78 16 d8  23 35 92 5e 82 28 7d 04  |.v_.xx..#5.^.(}.|
00000030  a7 86 69 74 1f f0 65 8a  90 d8 a3 48 51 d9 2c 0a  |..it..e....HQ.,.|
00000040  c5 80 22 8c 59 c0 d3 83  0c 57 f9 10 94 76 3d ec  |..".Y....W...v=.|
00000050  50 26 f9 ac 0f 25 64 e0  bc 09 83 6d 99 b5 50 5d  |P&...%d....m..P]|
00000060  fe 39 31 5e da 1f 48 1d  2a fd aa d8 19 f9 20 62  |.91^..H.*..... b|
00000070  2e 7d 51 c2 0e 02 ab b0  c9 6e 6b c2 19 44 b8 bd  |.}Q......nk..D..|
00000080  dd 73 09 16 c6 37 66 23  7c bd 35 5c 40 00 eb 26  |.s...7f#|.5\@..&|
00000090  05 7e 61 89 78 05 19 7b  ed 87 d4 f2 aa 99 4b bf  |.~a.x..{......K.|
000000a0  5c 1d 05 4c 0c 83 01 75  df 70 64 53 bf d4 08 b1  |\..L...u.pdS....|
000000b0  0b 57 4d 62 1f cb 6d d4  43 c5 c0 82 5c 4b d9 cb  |.WMb..m.C...\K..|
000000c0  ed c6 b3 7d a9 27 c6 dc  c4 8b c2 aa c6 0c de 71  |...}.'.........q|
000000d0  1e 89 c0 96 89 0f f4 bd  13 0b e9 a4 b3 54 42 e2  |.............TB.|
000000e0  e3 89 a9 6e 15 d5 03 be  59 df 8e 69 48 8d 94 e2  |...n....Y..iH...|
000000f0  e6 e1 86 44 5b 94 a1 d5  fe 9d c0 08 da 93 71 bd  |...D[.........q.|
... 512 bytes shown in part

2026-10-10 18:33:36103.203.57.24to 500/udpUnrecognisedCN

·9·`·D·8· · · · ·

payload bytes

00000000  00 00 00 00 cc 14 b8 39  00 00 00 00 00 00 00 00  |.......9........|
00000010  01 10 02 00 00 00 00 00  00 00 01 60 00 00 01 44  |...........`...D|
00000020  00 00 00 01 00 00 00 01  00 00 01 38 01 01 00 0d  |...........8....|
00000030  03 00 00 20 00 01 00 00  80 01 00 05 80 02 00 02  |... ............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 80 0c 00 01  |................|
00000050  03 00 00 20 00 01 00 00  80 01 00 01 80 02 00 01  |... ............|
00000060  80 03 00 01 80 04 00 02  80 0b 00 01 80 0c 00 01  |................|
00000070  03 00 00 20 00 01 00 00  80 01 00 07 80 02 00 04  |... ............|
00000080  80 03 00 01 80 04 00 0e  80 0b 00 01 80 0c 00 01  |................|
00000090  03 00 00 14 00 01 00 00  80 01 00 05 80 02 00 02  |................|
000000a0  80 03 00 02 03 00 00 14  00 01 00 00 80 01 00 05  |................|
000000b0  80 02 00 02 80 03 00 03  03 00 00 14 00 01 00 00  |................|
000000c0  80 01 00 05 80 02 00 02  80 03 00 04 03 00 00 14  |................|
000000d0  00 01 00 00 80 01 00 05  80 02 00 02 80 03 00 08  |................|
000000e0  03 00 00 14 00 01 00 00  80 01 00 05 80 02 00 02  |................|
000000f0  80 03 fa dd 03 00 00 14  00 01 00 00 80 01 00 05  |................|
... 352 bytes shown in part

2026-10-10 17:52:00103.203.57.24to 500/udpUnrecognisedCN

·d·X·`·D·8· · · · ·

payload bytes

00000000  00 00 00 00 64 9f 58 f7  00 00 00 00 00 00 00 00  |....d.X.........|
00000010  01 10 02 00 00 00 00 00  00 00 01 60 00 00 01 44  |...........`...D|
00000020  00 00 00 01 00 00 00 01  00 00 01 38 01 01 00 0d  |...........8....|
00000030  03 00 00 20 00 01 00 00  80 01 00 05 80 02 00 02  |... ............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 80 0c 00 01  |................|
00000050  03 00 00 20 00 01 00 00  80 01 00 01 80 02 00 01  |... ............|
00000060  80 03 00 01 80 04 00 02  80 0b 00 01 80 0c 00 01  |................|
00000070  03 00 00 20 00 01 00 00  80 01 00 07 80 02 00 04  |... ............|
00000080  80 03 00 01 80 04 00 0e  80 0b 00 01 80 0c 00 01  |................|
00000090  03 00 00 14 00 01 00 00  80 01 00 05 80 02 00 02  |................|
000000a0  80 03 00 02 03 00 00 14  00 01 00 00 80 01 00 05  |................|
000000b0  80 02 00 02 80 03 00 03  03 00 00 14 00 01 00 00  |................|
000000c0  80 01 00 05 80 02 00 02  80 03 00 04 03 00 00 14  |................|
000000d0  00 01 00 00 80 01 00 05  80 02 00 02 80 03 00 08  |................|
000000e0  03 00 00 14 00 01 00 00  80 01 00 05 80 02 00 02  |................|
000000f0  80 03 fa dd 03 00 00 14  00 01 00 00 80 01 00 05  |................|
... 352 bytes shown in part

2026-10-10 17:42:31103.203.57.10to 500/udpUnrecognisedCN

·fG·`·D·8· · · · ·

payload bytes

00000000  00 00 00 00 66 47 a0 dd  00 00 00 00 00 00 00 00  |....fG..........|
00000010  01 10 02 00 00 00 00 00  00 00 01 60 00 00 01 44  |...........`...D|
00000020  00 00 00 01 00 00 00 01  00 00 01 38 01 01 00 0d  |...........8....|
00000030  03 00 00 20 00 01 00 00  80 01 00 05 80 02 00 02  |... ............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 80 0c 00 01  |................|
00000050  03 00 00 20 00 01 00 00  80 01 00 01 80 02 00 01  |... ............|
00000060  80 03 00 01 80 04 00 02  80 0b 00 01 80 0c 00 01  |................|
00000070  03 00 00 20 00 01 00 00  80 01 00 07 80 02 00 04  |... ............|
00000080  80 03 00 01 80 04 00 0e  80 0b 00 01 80 0c 00 01  |................|
00000090  03 00 00 14 00 01 00 00  80 01 00 05 80 02 00 02  |................|
000000a0  80 03 00 02 03 00 00 14  00 01 00 00 80 01 00 05  |................|
000000b0  80 02 00 02 80 03 00 03  03 00 00 14 00 01 00 00  |................|
000000c0  80 01 00 05 80 02 00 02  80 03 00 04 03 00 00 14  |................|
000000d0  00 01 00 00 80 01 00 05  80 02 00 02 80 03 00 08  |................|
000000e0  03 00 00 14 00 01 00 00  80 01 00 05 80 02 00 02  |................|
000000f0  80 03 fa dd 03 00 00 14  00 01 00 00 80 01 00 05  |................|
... 352 bytes shown in part

2026-10-10 17:06:26113.206.146.178to 5008/udpUnrecognisedCN

·@P·]·(·|·@·9·B7e·

payload bytes

00000000  00 40 50 00 00 00 00 85  5d b4 91 28 00 00 00 00  |.@P.....]..(....|
00000010  00 01 7c 91 40 00 00 00  aa 39 da 42 37 65 cf 01  |..|.@....9.B7e..|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|