UDP traffic

Datagrams matching proto:google sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

25 datagrams from 12 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 25

Latest DNS datagram, to 53/udp

DNS query A www.google.com

payload bytes

00000000  ae 0d 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

Other services

23 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

GOOGLE 23

Latest GOOGLE datagram, to 443/udp

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS·SCLS·KEXS·XLCT·CSCT·COPT·CCRT$·IRTT(·CFCW,·SFCW0·--------------------

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	25	12	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS25
443/udp GOOGLE23

DNS questions

DNS record types

A24
ANY1

Networks

AS9009 M247 Europe SRL from 1 source23
AS16509 Amazon.com, Inc. from 5 sources13
AS264617 GRUPO PANAGLOBAL 15 S.A from 1 source6
AS10439 CariNet, Inc. from 3 sources3
AS50219 Valence Technology Co. from 1 source1
AS401626 Netiface America, Inc. from 1 source1
AS14061 DigitalOcean, LLC from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.200.118.46	AS9009 M247 Europe SRL	GB	GOOGLE	23	2026-10-10 22:30
185.191.236.38	AS264617 GRUPO PANAGLOBAL 15 S.A	CH	DNS	6	2026-10-08 20:29
13.58.25.240	AS16509 Amazon.com, Inc.	US	DNS	4	2026-10-07 13:16
18.226.68.29	AS16509 Amazon.com, Inc.	US	DNS	4	2026-10-06 13:13
52.14.245.101	AS16509 Amazon.com, Inc.	US	DNS	2	2026-10-08 12:08
18.188.181.94	AS16509 Amazon.com, Inc.	US	DNS	2	2026-10-10 12:34
13.59.254.158	AS16509 Amazon.com, Inc.	US	DNS	1	2026-10-10 13:51
71.6.134.232	AS10439 CariNet, Inc.	US	DNS	1	2026-10-06 13:54
165.227.88.201	AS14061 DigitalOcean, LLC	US	DNS	1	2026-10-05 21:37
71.6.134.231	AS10439 CariNet, Inc.	US	DNS	1	2026-10-10 14:59
216.226.76.10	AS50219 Valence Technology Co.	US	DNS	1	2026-10-10 14:04
71.6.134.236	AS10439 CariNet, Inc.	US	DNS	1	2026-10-08 03:30
64.89.163.247	AS401626 Netiface America, Inc.	US	DNS	1	2026-10-09 00:54

Latest datagrams

2026-10-10 22:30:40185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 22:24:33185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 20:10:10185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 17:04:26185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 14:59:1871.6.134.231to 53/udpDNSUS

DNS query A www.google.com

payload bytes

00000000  ae 0d 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

2026-10-10 14:04:04216.226.76.10to 53/udpDNSUS

DNS query A www.google.com

payload bytes

00000000  ae 0d 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

2026-10-10 13:51:4613.59.254.158to 53/udpDNSUS

DNS query A google.com

payload bytes

00000000  b7 80 00 00 00 01 00 00  00 00 00 00 06 67 6f 6f  |.............goo|
00000010  67 6c 65 03 63 6f 6d 00  00 01 00 01              |gle.com.....|

2026-10-10 12:34:3818.188.181.94to 53/udpDNSUS

DNS query A google.com

payload bytes

00000000  2f 06 00 00 00 01 00 00  00 00 00 00 06 67 6f 6f  |/............goo|
00000010  67 6c 65 03 63 6f 6d 00  00 01 00 01              |gle.com.....|

2026-10-10 12:30:3618.188.181.94to 53/udpDNSUS

DNS query A google.com

payload bytes

00000000  99 95 00 00 00 01 00 00  00 00 00 00 06 67 6f 6f  |.............goo|
00000010  67 6c 65 03 63 6f 6d 00  00 01 00 01              |gle.com.....|

2026-10-09 17:10:09185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-09 15:02:45185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-09 13:25:13185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-09 11:27:53185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-09 00:54:5564.89.163.247to 53/udpDNSUS

DNS query ANY google.com

payload bytes

00000000  79 f1 01 20 00 01 00 00  00 00 00 01 06 67 6f 6f  |y.. .........goo|
00000010  67 6c 65 03 63 6f 6d 00  00 ff 00 01 00 00 29 10  |gle.com.......).|
00000020  00 00 00 00 00 00 00                              |.......|

2026-10-08 21:10:27185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part