[Dshield] Strange udp/53 traffic...

Jeff Kell jeff-kell at utc.edu
Wed Mar 31 23:21:37 GMT 2004


Anyone know what this might be?  Some P2P abomination or a bot-net?

> Local IP Remote IP  Proto- Local Remote Incoming Outgoing Incoming Outgoing First Packet Last Packet  First Last    col Port  Port Bytes  Bytes Packets  Packets Time Time  Talker Talker
> 172.18.81.21 24.8.237.22 udp 53 53 0 54 0 1 17:30:05.9532 17:30:05.9532 L -
> 172.18.81.21 222.37.67.202 udp 53 53 0 54 0 1 17:30:11.0048 17:30:11.0048 L -
> 172.18.81.21 80.24.213.75 udp 53 29457 0 54 0 1 17:30:16.5122 17:30:16.5122 L -
> 172.18.81.21 150.94.210.116 udp 53 53 0 54 0 1 17:30:21.5172 17:30:21.5172 L -
> 172.18.81.21 80.37.150.110 udp 53 53 0 54 0 1 17:30:27.0269 17:30:27.0269 L -
> 172.18.81.21 169.251.253.167 udp 53 53 0 54 0 1 17:30:32.0318 17:30:32.0318 L -
> 172.18.81.21 211.63.177.181 udp 53 16074 0 54 0 1 17:30:37.5365 17:30:37.5365 L -
> 172.18.81.21 221.156.179.70 udp 53 53 0 54 0 1 17:30:42.6365 17:30:42.6365 L -
> 172.18.81.21 68.168.115.83 udp 53 53 0 54 0 1 17:30:48.1412 17:30:48.1412 L -
> 172.18.81.21 214.217.64.74 udp 53 53 0 54 0 1 17:30:53.1869 17:30:53.1869 L -
> 172.18.81.21 68.12.155.53 udp 53 10091 0 54 0 1 17:30:58.6908 17:30:58.6908 L -
> 172.18.81.21 181.118.135.17 udp 53 53 0 54 0 1 17:31:03.7159 17:31:03.7159 L - 

Jeff




More information about the list mailing list