[Dshield] [LOGS] UDP:27015 - Halflife?

John Sage jsage at finchhaven.com
Wed Sep 25 06:24:04 GMT 2002


Noticed this; Halflife?

Typically one "ping" followed by four "infostring"'s


------------------------------------------------------------------------------
#(412 - 489) [2002-09-24 19:53:52]  UDP to range 1026-60999
IPv4: 64.228.88.71 -> 12.82.129.165
      hlen=5 TOS=0 dlen=37 ID=33885 flags=0 offset=0 TTL=110 chksum=41288
UDP:  port=3654 -> dport: 27015 len=17
Payload:  length = 9

000 : FF FF FF FF 70 69 6E 67 00                        ....ping.
------------------------------------------------------------------------------
#(412 - 490) [2002-09-24 19:53:54]  UDP to range 1026-60999
IPv4: 64.228.88.71 -> 12.82.129.165
      hlen=5 TOS=0 dlen=44 ID=34015 flags=0 offset=0 TTL=110 chksum=41151
UDP:  port=3654 -> dport: 27015 len=24
Payload:  length = 16

000 : FF FF FF FF 69 6E 66 6F 73 74 72 69 6E 67 0A 00   ....infostring..
------------------------------------------------------------------------------
#(412 - 491) [2002-09-24 19:53:56]  UDP to range 1026-60999
IPv4: 64.228.88.71 -> 12.82.129.165
      hlen=5 TOS=0 dlen=44 ID=34077 flags=0 offset=0 TTL=110 chksum=41089
UDP:  port=3654 -> dport: 27015 len=24
Payload:  length = 16

000 : FF FF FF FF 69 6E 66 6F 73 74 72 69 6E 67 0A 00   ....infostring..
------------------------------------------------------------------------------
#(412 - 492) [2002-09-24 19:53:58]  UDP to range 1026-60999
IPv4: 64.228.88.71 -> 12.82.129.165
      hlen=5 TOS=0 dlen=44 ID=34120 flags=0 offset=0 TTL=110 chksum=41046
UDP:  port=3654 -> dport: 27015 len=24
Payload:  length = 16

000 : FF FF FF FF 69 6E 66 6F 73 74 72 69 6E 67 0A 00   ....infostring..
------------------------------------------------------------------------------
#(412 - 493) [2002-09-24 19:54:00]  UDP to range 1026-60999
IPv4: 64.228.88.71 -> 12.82.129.165
      hlen=5 TOS=0 dlen=44 ID=34164 flags=0 offset=0 TTL=110 chksum=41002
UDP:  port=3654 -> dport: 27015 len=24
Payload:  length = 16

000 : FF FF FF FF 69 6E 66 6F 73 74 72 69 6E 67 0A 00   ....infostring..
------------------------------------------------------------------------------
:
<snip>
:
------------------------------------------------------------------------------
#(412 - 497) [2002-09-24 20:18:31]  UDP to range 1026-60999
IPv4: 218.106.212.31 -> 12.82.129.165
      hlen=5 TOS=0 dlen=37 ID=46920 flags=0 offset=0 TTL=106 chksum=23806
UDP:  port=1656 -> dport: 27015 len=17
Payload:  length = 9

000 : FF FF FF FF 70 69 6E 67 00                        ....ping.
------------------------------------------------------------------------------
#(412 - 498) [2002-09-24 20:18:33]  UDP to range 1026-60999
IPv4: 218.106.212.31 -> 12.82.129.165
      hlen=5 TOS=0 dlen=44 ID=23881 flags=0 offset=0 TTL=106 chksum=46838
UDP:  port=1656 -> dport: 27015 len=24
Payload:  length = 16

000 : FF FF FF FF 69 6E 66 6F 73 74 72 69 6E 67 0A 00   ....infostring..
------------------------------------------------------------------------------
#(412 - 499) [2002-09-24 20:18:35]  UDP to range 1026-60999
IPv4: 218.106.212.31 -> 12.82.129.165
      hlen=5 TOS=0 dlen=44 ID=60745 flags=0 offset=0 TTL=106 chksum=9974
UDP:  port=1656 -> dport: 27015 len=24
Payload:  length = 16

000 : FF FF FF FF 69 6E 66 6F 73 74 72 69 6E 67 0A 00   ....infostring..
------------------------------------------------------------------------------
#(412 - 500) [2002-09-24 20:18:37]  UDP to range 1026-60999
IPv4: 218.106.212.31 -> 12.82.129.165
      hlen=5 TOS=0 dlen=44 ID=25674 flags=0 offset=0 TTL=106 chksum=45045
UDP:  port=1656 -> dport: 27015 len=24
Payload:  length = 16

000 : FF FF FF FF 69 6E 66 6F 73 74 72 69 6E 67 0A 00   ....infostring..
------------------------------------------------------------------------------
#(412 - 501) [2002-09-24 20:18:39]  UDP to range 1026-60999
IPv4: 218.106.212.31 -> 12.82.129.165
      hlen=5 TOS=0 dlen=44 ID=55882 flags=0 offset=0 TTL=106 chksum=14837
UDP:  port=1656 -> dport: 27015 len=24
Payload:  length = 16

000 : FF FF FF FF 69 6E 66 6F 73 74 72 69 6E 67 0A 00   ....infostring..
------------------------------------------------------------------------------



- John
-- 
"It's a troll! Run!^H^H^H^H Laugh!"

PGP key:     http://www.finchhaven.com/pages/gpg_pubkey.html
Fingerprint: C493 9F26 05A9 6497 9800  4EF6 5FC8 F23D 35A4 F705




More information about the list mailing list