Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am noticing a bunch of UDP traffic hitting a server on a shared IP. Is there anyway to tell which site they may be trying to it?

share|improve this question
    
possible duplicate of My server's been hacked EMERGENCY –  Lucas Kauffman Sep 17 '12 at 20:26
1  
@LucasKauffman How about let's wait until he is hacked first. :) –  Michael Hampton Sep 17 '12 at 20:30
    
You won't know until you try. Look at the UDP traffic and see what you can figure out. What port is it to? –  David Schwartz Sep 17 '12 at 21:02
    
The ports are random ones that don't have services –  Jake Mach Sep 17 '12 at 21:06
    
What makes you think the attempts are against a site? All indications are that the target is the server itself. –  John Gardeniers Sep 17 '12 at 21:54
show 2 more comments

closed as not constructive by Lucas Kauffman, John Gardeniers, Greg Askew, rnxrx, Michael Hampton Sep 18 '12 at 14:06

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 4 down vote accepted

Not unless the body of the packet contains this information. Sniff it using tcpdump or wireshark, and look.

Once you resolve a DNS name into an IP, it's not possible to reverse it back (DNS -> IP is many-to-one).

share|improve this answer
    
Is there a better flag option then other flag options to use to sniff the packets? –  Jake Mach Sep 17 '12 at 21:07
    
What do you know about the packets you're receiving (in terms of format)? –  Jay Sep 17 '12 at 22:12
    
I just need to know how to figure out what domain being hosted is being targeted by the attack. –  Jake Mach Sep 17 '12 at 22:55
add comment

The challenge here is that UDP traffic is trivial to forge.

Your ISP might be able to help you filter out the traffic if it is significant, but without the cooperation of all ISPs, there is no way to trace UDP traffic with a high level of certainty.

If the person sending the packets have provided false/invalid source ip/port information, there really is nothing you can do to trace them.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.