HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching port:69 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

131

Datagrams

75

Source addresses

17

Networks

11

Countries

1

Destination ports

Traffic by type

Service queries

120 datagrams from 69 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

TFTP 120

Latest TFTP datagram, to 69/udp

·mac.xml·octet·

payload bytes
00000000  00 01 6d 61 63 2e 78 6d  6c 00 6f 63 74 65 74 00  |..mac.xml.octet.|

Unrecognised

11 datagrams from 8 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 11

Latest Unrecognised datagram, to 69/udp

·

payload bytes
00000000  00 01 00 02 00 01 00                              |.......|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
TFTP69/udp1317560

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
122.8.156.185AS136907 HUAWEI CLOUDSTHTFTP322026-10-11 08:15
16.5.0.234AS401661 EMBNEX, LLCBRTFTP52026-10-05 19:06
144.172.115.75AS14956 RouterHosting LLCUSTFTP42026-10-08 19:36
94.154.43.251AS219502 Storm Industries LLCNLTFTP42026-10-09 10:50
139.162.159.191AS63949 Akamai Connected CloudDETFTP42026-10-08 08:48
146.190.72.24AS14061 DigitalOcean, LLCUSUnrecognised32026-10-06 17:05
193.47.62.187AS216014 BestDC LimitedBGTFTP32026-10-08 03:45
146.88.241.110AS20052 Arbor Networks, Inc.USTFTP22026-10-09 10:43
146.88.241.170AS20052 Arbor Networks, Inc.USTFTP22026-10-07 06:43
217.60.76.58AS401626 Netiface America, Inc.AETFTP22026-10-08 10:21
45.156.129.88AS211680 Sistemas Informaticos, S.A.PTUnrecognised22026-10-08 02:43
146.88.240.40AS20052 Arbor Networks, Inc.USTFTP22026-10-06 13:20
47.77.227.236AS45102 Alibaba (US) Technology Co., Ltd.USUnrecognised22026-10-11 06:51
64.62.197.88AS6939 Hurricane Electric LLCUSTFTP22026-10-10 06:10
47.88.3.88AS45102 Alibaba (US) Technology Co., Ltd.USUnrecognised22026-10-09 16:01
147.185.132.159AS396982 Google LLCUSTFTP12026-10-10 22:39
185.180.141.9AS21859 Zenlayer IncPTTFTP12026-10-09 08:10
65.49.1.94AS6939 Hurricane Electric LLCUSTFTP12026-10-07 02:30
109.105.210.65AS21859 Zenlayer IncPTUnrecognised12026-10-09 08:10
64.62.156.36AS6939 Hurricane Electric LLCUSTFTP12026-10-06 04:27

Latest datagrams