Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I noticed I was getting udp traffic on random ports from an unknown ip address that was definitely not on my domain today. When I looked up the ip using nslookup, it returned a name. But when I did a whois on both name whois complained that the name had expired and didn't give me back any information. So I tried the ip on whois, and whois couldn't find it at all.

How is this possible?

share|improve this question
What is the IP ? – Dave Cheney Mar 4 '10 at 3:51
I don't remember :-p I had intended to check it out later, but then I cleared wireshark's cache – mechko Mar 4 '10 at 15:04

It is possible that the domain has expired very recently and the DNS servers are just returning the name they have cached. If this is the case, the behaviour shouldn't continue for long; 48hrs is usually the max.

share|improve this answer

Keep in mind that UDP traffic is not stateful, so these packets could be forged.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.