0

On one of my external hostet vservers I got a lot of traffic to multicast addresses (SRC-IP Changed)

22:09:38.804122 IP 1.2.3.4.51960 > 255.255.255.255.6112: UDP, length 128

22:15:02.787315 IP 4.5.6.7.17500 > 255.255.255.255.17500: UDP, length 167

22:15:02.791780 IP 4.5.6.7.17500 > 109.75.188.255.17500: UDP, length 167

Could anybody tell me, what this is?

Improve this question
2
  • 109.75.188.255 is not a multicast address. It could be a broadcast to the subnet that your virtual server is in. Is your server's subnet 109.75.188.0/24?
    – HeatfanJohn
    Commented Sep 23, 2012 at 21:18
  • 255.255.255.255 also is a broadcast address.
    – wnrph
    Commented Sep 23, 2012 at 22:11

1 Answer 1

Reset to default
1

There is nothing suspicious about these packets. If they were in any way malicious you couldn't tell it from this list alone.

You'd have to have a deeper look. E.g. you could analyze the situation with Wireshark. It often recognizes the application protocols (i.e. what's inside e.g. the packets) and even describes the meaning of the individual packets with regard to the protocol.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .