Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On one of my external hostet vservers I got a lot of traffic to multicast addresses (SRC-IP Changed)

22:09:38.804122 IP > UDP, length 128

22:15:02.787315 IP > UDP, length 167

22:15:02.791780 IP > UDP, length 167

Could anybody tell me, what this is?

share|improve this question

closed as not a real question by Diogo, Indrek, Sirex, Randolph West, bwDraco Sep 24 '12 at 5:21

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question. is not a multicast address. It could be a broadcast to the subnet that your virtual server is in. Is your server's subnet – HeatfanJohn Sep 23 '12 at 21:18 also is a broadcast address. – artistoex Sep 23 '12 at 22:11

There is nothing suspicious about these packets. If they were in any way malicious you couldn't tell it from this list alone.

You'd have to have a deeper look. E.g. you could analyze the situation with Wireshark. It often recognizes the application protocols (i.e. what's inside e.g. the packets) and even describes the meaning of the individual packets with regard to the protocol.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.