Question:
How do I check what is causing UDP traffic?
?
2009-07-11 16:46:38 UTC
My outbound traffic suddenly increased. I have blocked the traffic with Peer Guardian but I can't find the source.
Peer Guardian shows 72.20.34.145 dialling out on a UDP port every couple of minutes. I know this is a bittorrent address - but I have no torrents installed. PLEASE help me find the application causing this so I can get rid of the source.
Three answers:
2009-07-11 17:05:54 UTC
Maybe try this...
2009-07-11 16:53:37 UTC
Maybe this can help? These are common actions carried out over the UDP protocol (the numbers are port numbers)





53





domain





Domain Name Server (DNS)





Uses a simple request/reply messaging system for most exchanges (but also uses TCP for longer ones).



67 and 68





bootps / bootpc





Bootstrap Protocol (BOOTP) and Dynamic Host Configuration Protocol (DHCP)





Host configuration protocols that consist of short request and reply exchanges.



69





tftp





Trivial File Transfer Protocol (TFTP)





TFTP is a great example of a protocol that was specifically designed for UDP, especially when it is compared to regular FTP. The latter protocol uses TCP to establish a session between two devices, and then makes use of its own large command set and TCP's features to ensure reliable transfer of possibly very large files. In contrast, TFTP is designed for the quick and easy transfer of small files. It includes simple versions of some of TCP's features, such as acknowledgments, to avoid file corruption.



161 and 162





snmp





Simple Network Management Protocol





An administrative protocol that uses relatively short messages.



520 and 521





router / ripng





Routing Information Protocol (RIP-1, RIP-2, RIPng)





Unlike more complex routing protocols like BGP, RIP uses a simple request/reply messaging system, doesn't require connections, and does require multicasts/broadcasts. This makes it a natural choice for UDP. If a routing update is sent due to a request and is lost, it can be replaced by sending a new request. Routine (unsolicited) updates that are lost are replaced in the next cycle.



2049





nfs





Network File System





NFS is an interesting case. Since it is a file sharing protocol, one would think that it would use TCP instead of UDP, but it was originally designed to use UDP for performance reasons. There were many people who felt this was not the best design decision, and later versions moved to the use of TCP. The latest version of NFS uses only TCP.























As For your IP address it seems to belong to Utorrent?
Synful Visions
2009-07-11 17:02:45 UTC
http://www.foundstone.com/us/resources/proddesc/fport.htm



FPort traces TCP and UDP connections to their corresponding applications.


This content was originally posted on Y! Answers, a Q&A website that shut down in 2021.
Loading...