HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching port:32414 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

40

Datagrams

29

Source addresses

5

Networks

3

Countries

1

Destination ports

Traffic by type

Service queries

8 datagrams from 5 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SSDP 8

Latest SSDP datagram, to 32414/udp

M-SEARCH * HTTP/1.1

payload bytes
00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a                                    |1.1..|

Unrecognised

32 datagrams from 24 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 32

Latest Unrecognised datagram, to 32414/udp

M

payload bytes
00000000  4d                                                |M|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
SSDP32414/udp8530.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
16.5.0.234AS401661 EMBNEX, LLCBRUnrecognised62026-10-05 18:20
45.33.84.114AS63949 Akamai Connected CloudUSUnrecognised42026-10-06 15:08
146.88.241.50AS20052 Arbor Networks, Inc.USSSDP22026-10-08 06:49
146.88.241.100AS20052 Arbor Networks, Inc.USSSDP22026-10-08 02:38
146.88.241.150AS20052 Arbor Networks, Inc.USSSDP22026-10-10 11:16
64.62.197.216AS6939 Hurricane Electric LLCUSUnrecognised12026-10-08 07:14
64.62.156.71AS6939 Hurricane Electric LLCUSUnrecognised12026-10-06 03:12
65.49.1.114AS6939 Hurricane Electric LLCUSUnrecognised12026-10-10 05:40
64.62.156.33AS6939 Hurricane Electric LLCUSUnrecognised12026-10-10 02:41
216.218.206.113AS6939 Hurricane Electric LLCUSUnrecognised12026-10-11 00:44
64.62.156.73AS6939 Hurricane Electric LLCUSUnrecognised12026-10-07 02:10
65.49.1.33AS6939 Hurricane Electric LLCUSUnrecognised12026-10-06 02:24
65.49.1.63AS6939 Hurricane Electric LLCUSUnrecognised12026-10-09 05:04
65.49.1.13AS6939 Hurricane Electric LLCUSUnrecognised12026-10-09 01:13
184.105.247.252AS6939 Hurricane Electric LLCUSUnrecognised12026-10-07 06:14
64.62.156.12AS6939 Hurricane Electric LLCUSUnrecognised12026-10-06 02:42
65.49.1.21AS6939 Hurricane Electric LLCUSUnrecognised12026-10-10 05:21
106.75.175.147AS58466 CHINANET Guangdong province networkCNUnrecognised12026-10-09 05:16
64.62.156.19AS6939 Hurricane Electric LLCUSUnrecognised12026-10-06 03:02
184.105.247.227AS6939 Hurricane Electric LLCUSUnrecognised12026-10-09 05:43

Latest datagrams