HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching port:69 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

125

Datagrams

73

Source addresses

17

Networks

11

Countries

1

Destination ports

Traffic by type

Service queries

116 datagrams from 68 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

TFTP 116

Latest TFTP datagram, to 69/udp

·a.pdf·octet·

payload bytes
00000000  00 01 61 2e 70 64 66 00  6f 63 74 65 74 00        |..a.pdf.octet.|

Unrecognised

9 datagrams from 7 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 9

Latest Unrecognised datagram, to 69/udp

·'·8O·

payload bytes
00000000  00 00 04 17 27 10 19 80  00 00 00 00 38 4f 89 8b  |....'.......8O..|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
TFTP69/udp1257360

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
122.8.156.185AS136907 HUAWEI CLOUDSTHTFTP292026-10-11 01:30
16.5.0.234AS401661 EMBNEX, LLCBRTFTP52026-10-05 19:06
144.172.115.75AS14956 RouterHosting LLCUSTFTP42026-10-08 19:36
94.154.43.251AS219502 Storm Industries LLCNLTFTP42026-10-09 10:50
139.162.159.191AS63949 Akamai Connected CloudDETFTP42026-10-08 08:48
146.190.72.24AS14061 DigitalOcean, LLCUSUnrecognised32026-10-06 17:05
193.47.62.187AS216014 BestDC LimitedBGTFTP32026-10-08 03:45
146.88.241.110AS20052 Arbor Networks, Inc.USTFTP22026-10-09 10:43
146.88.241.170AS20052 Arbor Networks, Inc.USTFTP22026-10-07 06:43
217.60.76.58AS401626 Netiface America, Inc.AETFTP22026-10-08 10:21
45.156.129.88AS211680 Sistemas Informaticos, S.A.PTUnrecognised22026-10-08 02:43
146.88.240.40AS20052 Arbor Networks, Inc.USTFTP22026-10-06 13:20
64.62.197.88AS6939 Hurricane Electric LLCUSTFTP22026-10-10 06:10
47.88.3.88AS45102 Alibaba (US) Technology Co., Ltd.USUnrecognised22026-10-09 16:01
147.185.132.159AS396982 Google LLCUSTFTP12026-10-10 22:39
64.62.156.55AS6939 Hurricane Electric LLCUSTFTP12026-10-09 06:40
65.49.1.94AS6939 Hurricane Electric LLCUSTFTP12026-10-07 02:30
109.105.210.65AS21859 Zenlayer IncPTUnrecognised12026-10-09 08:10
185.180.141.9AS21859 Zenlayer IncPTTFTP12026-10-09 08:10
64.62.156.36AS6939 Hurricane Electric LLCUSTFTP12026-10-06 04:27

Latest datagrams