Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am noticing a bunch of UDP traffic hitting a server on a shared IP. Is there anyway to tell which site they may be trying to it?

share|improve this question

closed as not constructive by Lucas Kauffman, John Gardeniers, Greg Askew, rnxrx, Michael Hampton Sep 18 '12 at 14:06

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

possible duplicate of My server's been hacked EMERGENCY – Lucas Kauffman Sep 17 '12 at 20:26
@LucasKauffman How about let's wait until he is hacked first. :) – Michael Hampton Sep 17 '12 at 20:30
You won't know until you try. Look at the UDP traffic and see what you can figure out. What port is it to? – David Schwartz Sep 17 '12 at 21:02
The ports are random ones that don't have services – Jake Mach Sep 17 '12 at 21:06
What makes you think the attempts are against a site? All indications are that the target is the server itself. – John Gardeniers Sep 17 '12 at 21:54
up vote 4 down vote accepted

Not unless the body of the packet contains this information. Sniff it using tcpdump or wireshark, and look.

Once you resolve a DNS name into an IP, it's not possible to reverse it back (DNS -> IP is many-to-one).

share|improve this answer
Is there a better flag option then other flag options to use to sniff the packets? – Jake Mach Sep 17 '12 at 21:07
What do you know about the packets you're receiving (in terms of format)? – Jay Sep 17 '12 at 22:12
I just need to know how to figure out what domain being hosted is being targeted by the attack. – Jake Mach Sep 17 '12 at 22:55

The challenge here is that UDP traffic is trivial to forge.

Your ISP might be able to help you filter out the traffic if it is significant, but without the cooperation of all ISPs, there is no way to trace UDP traffic with a high level of certainty.

If the person sending the packets have provided false/invalid source ip/port information, there really is nothing you can do to trace them.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.