UDP traffic

Datagrams matching country:NO sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

5 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 5

Latest NTP datagram, to 123/udp

#·s· ޭ·

payload bytes

00000000  23 00 06 ec 00 00 00 00  00 00 00 00 00 00 00 00  |#...............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ee 73 b9 cd 00 00 00 00  |.........s......|
00000030  ca fe f0 0d de ad be ef  cb 0c 00 ce cf 0c 05 0e  |................|
00000040  00 00 00 00 00 00 00 00  01 00 00                 |...........|

Unrecognised

20 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 20

Latest Unrecognised datagram, to 34452/udp

payload bytes

00000000  9c                                                |.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NTP	123/udp	5	1	556.9

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

34452/udp20
123/udp NTP5

Networks

AS29695 Lyse Tele from 1 source20
AS50304 Blix Solutions AS from 1 source5

Countries

NO Norway25

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
51.174.171.127	AS29695 Lyse Tele	NO	Unrecognised	20	2026-10-09 21:33
185.12.59.116	AS50304 Blix Solutions AS	NO	NTP	5	2026-10-10 21:21

Latest datagrams

2026-10-10 21:21:34185.12.59.116to 123/udpNTPNO

#·s· ޭ·

payload bytes

00000000  23 00 06 ec 00 00 00 00  00 00 00 00 00 00 00 00  |#...............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ee 73 b9 cd 00 00 00 00  |.........s......|
00000030  ca fe f0 0d de ad be ef  cb 0c 00 ce cf 0c 05 0e  |................|
00000040  00 00 00 00 00 00 00 00  01 00 00                 |...........|

2026-10-10 20:33:29185.12.59.116to 123/udpNTPNO

#·s· ޭ·

payload bytes

00000000  23 00 06 ec 00 00 00 00  00 00 00 00 00 00 00 00  |#...............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ee 73 b9 cd 00 00 00 00  |.........s......|
00000030  ca fe f0 0d de ad be ef  cb 0c 00 ce cf 0c 05 0e  |................|
00000040  00 00 00 00 00 00 00 00  01 00 00                 |...........|

2026-10-10 20:26:11185.12.59.116to 123/udpNTPNO

#·s· ޭ·

payload bytes

00000000  23 00 06 ec 00 00 00 00  00 00 00 00 00 00 00 00  |#...............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ee 73 b9 cd 00 00 00 00  |.........s......|
00000030  ca fe f0 0d de ad be ef  cb 0c 00 ce cf 0c 05 0e  |................|
00000040  00 00 00 00 00 00 00 00  01 00 00                 |...........|

2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```
2026-10-09 21:33:3951.174.171.127to 34452/udpUnrecognisedNO
·
payload bytes
```
00000000  9c                                                |.|
```