Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: UDP traffic to port 50368 SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
UDP traffic to port 50368
A reader (Bill) reported that he is seeing a substantial increase of UDP port 50368 traffic getting blocked by the firewall. The traffic appears to originate from Europe, and uses numerous source ports (but many of them are "well known").

Here a quick sample of sources and source ports
87.122.209.173/11069
81.219.217.70/9204
83.77.212.239/1037
172.212.40.49/8080
84.161.4.133/9086
82.251.45.191/10030
24.0.235.178/49308
83.40.83.84/11112
66.172.60.201/7871

No idea what's causing that. We have almost no other traffic to this port in our database. If you see any outbound traffic like that, let us know.

I will be teaching next: Intrusion Detection In-Depth - SANS Las Vegas Spring 2020

                                            		
                                            Johannes

                                                

                                                3838 Posts
ISC Handler		
                                        

                                        

                                            
                                        Subscribe
                                            
                                            
                                                Oct 24th 2005
1 decade  ago
                                            		

                                        

                                

                                

                                    
                                
Sign Up for Free or Log In to start participating in the conversation!