I can see with Wireshark that every 5 minutes I have a connection from my computer to ip 220.127.116.11 on udp/8253. This has been going for months. I cannot identify what application or process is making this connection. I used Wireshark to capture the traffic and all I can see is this: ... User Datagram Protocol, Src Port: 62841, Dst Port: 8253 Data (20 bytes) Data: a67c010000010000000000000269700000010001 [Length: 20]
followed by a reply from 18.104.22.168: ... User Datagram Protocol, Src Port: 8253, Dst Port: 62841 Data (36 bytes) Data: a67c810000010001000000000269700000010001c00c0001... [Length: 36]
I tried killing processes and seeing if the traffic stopped without any luck. The IP address seems to be a dynamically assigned one in Englewood, CO.
I am running now a Perl script recording the output of "
netstat -a -n -p tcp -b" every 0.1 seconds, hoping to record the culprit. So far no luck, the 0.1 seconds interval seems to miss the connection (recorded by Wireshark).
Any suggestions on how can I narrow down what application is making these connections?