0

I can see with Wireshark that every 5 minutes I have a connection from my computer to ip 165.254.162.243 on udp/8253. This has been going for months. I cannot identify what application or process is making this connection. I used Wireshark to capture the traffic and all I can see is this: ... User Datagram Protocol, Src Port: 62841, Dst Port: 8253 Data (20 bytes) Data: a67c010000010000000000000269700000010001 [Length: 20]

followed by a reply from 165.254.162.243: ... User Datagram Protocol, Src Port: 8253, Dst Port: 62841 Data (36 bytes) Data: a67c810000010001000000000269700000010001c00c0001... [Length: 36]

I tried killing processes and seeing if the traffic stopped without any luck. The IP address seems to be a dynamically assigned one in Englewood, CO.

I am running now a Perl script recording the output of "netstat -a -n -p tcp -b" every 0.1 seconds, hoping to record the culprit. So far no luck, the 0.1 seconds interval seems to miss the connection (recorded by Wireshark).

Any suggestions on how can I narrow down what application is making these connections?

Improve this question
6
  • What OS are you running on the machine in question?
    – joeqwerty
    Feb 9, 2017 at 3:33
  • I am running Windows 10. I decreased the interval for nestat to 0.05 seconds and still no luck capturing the process that is making the connection.
    – AdiGri
    Feb 9, 2017 at 3:35
  • can it be simply windows telemetry ?
    – yagmoth555 ♦
    Feb 9, 2017 at 3:41
  • Telemetry sending data to a single, dynamically assigned IP address in some town in Colorado on port udp/8253 with no references anywhere about it? It seems unlikely, but i modified the registries to disable it. Let's see if it makes any difference.
    – AdiGri
    Feb 9, 2017 at 3:48
  • My suggestion would be to download and run Microsoft Network Monitor (run as administrator) to capture the traffic and associate it with the process responsible for the process (which Microsoft Network Monitor will do). - microsoft.com/en-us/download/details.aspx?id=4865
    – joeqwerty
    Feb 9, 2017 at 5:06

1 Answer 1

Reset to default
4

Let us see...

The IP address 165.254.162.243 is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24.

A brief look at Google tells me Vitalwerks is the business name of NoIP.com, a dynamic DNS provider.

Have you installed a dynamic DNS update tool, or any other software, from this company? If so, you'll likely find it is the source.

If you have not, then you may find the source is malware. A few years ago, you may recall, Microsoft got a US federal court to authorize an extremely overbroad seizure of noip.com's domains in order to stop a botnet that was using some subdomains.

Improve this answer
1
  • Yes, it was the NoIP dynamic DNS client (installed as a service - NO-IP DUC v4.1.1). I've seen the No-Ip reference for 165.254.162.243 but for some reason I though it was a client of NoIP. Strange that there is no information on udp/8253 about that (but now there is!).
    – AdiGri
    Feb 9, 2017 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.