I am noticing a bunch of UDP traffic hitting a server on a shared IP. Is there anyway to tell which site they may be trying to it?
closed as not constructive by Lucas Kauffman, John Gardeniers, Greg Askew, rnxrx, Michael Hampton♦ Sep 18 '12 at 14:06
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.
Not unless the body of the packet contains this information. Sniff it using tcpdump or wireshark, and look.
Once you resolve a DNS name into an IP, it's not possible to reverse it back (DNS -> IP is many-to-one).
The challenge here is that UDP traffic is trivial to forge.
Your ISP might be able to help you filter out the traffic if it is significant, but without the cooperation of all ISPs, there is no way to trace UDP traffic with a high level of certainty.
If the person sending the packets have provided false/invalid source ip/port information, there really is nothing you can do to trace them.