UDP traffic

Datagrams matching port:5358 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 1

Latest SIP datagram, to 5358/udp

REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002849973 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002849973;rport Call-ID: c1002849973 CSeq: 1002849973 REGISTER Contact: <sip:10000@172.110.223.192:10016> Max-Forwards: 70 Expires: 3

Payload bytes withheld: they contain the sensor's address.

Unrecognised

1 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 1

Latest Unrecognised datagram, to 5358/udp

·M·f ·4Vx·8·

payload bytes

00000000  01 9e aa 4d 05 ad 9f 66  0d 00 ff ff 00 fe fe fe  |...M...f........|
00000010  fe fd fd fd fd 12 34 56  78 a9 a4 ec f0 9a 38 03  |......4Vx.....8.|
00000020  f5                                                |.|

Destination ports

5358/udp SIP2

Networks

AS23470 ReliableSite.Net LLC from 1 source1
AS26599 TELEFONICA BRASIL S.A from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
179.245.196.9	AS26599 TELEFONICA BRASIL S.A	BR	Unrecognised	1	2026-10-08 02:35
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	1	2026-10-10 23:43

Latest datagrams

2026-10-10 23:43:02172.110.223.192to 5358/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002849973 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002849973;rport Call-ID: c1002849973
Payload bytes withheld: they contain the sensor's address.

2026-10-08 02:35:26179.245.196.9to 5358/udpUnrecognisedBR

·M·f ·4Vx·8·

payload bytes

00000000  01 9e aa 4d 05 ad 9f 66  0d 00 ff ff 00 fe fe fe  |...M...f........|
00000010  fe fd fd fd fd 12 34 56  78 a9 a4 ec f0 9a 38 03  |......4Vx.....8.|
00000020  f5                                                |.|