Printable View
Hi,
I am getting logs from my router(Netgear) but I dont know what this is or which machine on the network is generating this. Can anyone help me?
UDP Packet - Source:65.255.54.196,58369 Destination:A.B.C.D,27515 - [DOS]
UDP Packet - Source:90.227.16.233,63327 Destination:A.B.C.D,27515 - [DOS]
A.B.C.D = my router ptp address. I run NAT on the network. I have about 10 workstations and I dont want to search each and everyone for spyware, torrent server, virus.
Any help?
Thanks
I get this type of UDP traffic when users are using a p2p (torrent, skype etc) and\or streaming video.
MLF
Weird?
The first IP is Cable & Wireless - Turks & Caicos Islands and the second is Telia Sonera AB - Sweden.
SANS suggests those ports might be being used by a new Twitter worm.
Note on morganlefay's comment: Do you allow p2p?
If someone installed a p2p or sharing client, it will go out on port 80 (usually) and advertise itself as participating on the network. Others will try and connect to them, initiating a connection that gets blocked inbound -- looking like a DoS attack. It'll usually look like a ton of attempts from all over the place (like a small DDoS). That's what I've seen on occasion here...
No...we dont allow P2P...
but we have a consultant that uses skype at times and it behaves just like a p2p client with IPs coming in from all over....
Router blocks it.....it creates alot of logs.....and I am altered right away when some little fooker starts up a p2p client
MLF