I can see with Wireshark that every 5 minutes I have a connection from my computer to ip on udp/8253. This has been going for months. I cannot identify what application or process is making this connection. I used Wireshark to capture the traffic and all I can see is this: ... User Datagram Protocol, Src Port: 62841, Dst Port: 8253 Data (20 bytes) Data: a67c010000010000000000000269700000010001 [Length: 20]

followed by a reply from ... User Datagram Protocol, Src Port: 8253, Dst Port: 62841 Data (36 bytes) Data: a67c810000010001000000000269700000010001c00c0001... [Length: 36]

I tried killing processes and seeing if the traffic stopped without any luck. The IP address seems to be a dynamically assigned one in Englewood, CO.

I am running now a Perl script recording the output of "netstat -a -n -p tcp -b" every 0.1 seconds, hoping to record the culprit. So far no luck, the 0.1 seconds interval seems to miss the connection (recorded by Wireshark).

Any suggestions on how can I narrow down what application is making these connections?

  • What OS are you running on the machine in question?
    – joeqwerty
    Feb 9, 2017 at 3:33
  • I am running Windows 10. I decreased the interval for nestat to 0.05 seconds and still no luck capturing the process that is making the connection.
    – AdiGri
    Feb 9, 2017 at 3:35
  • can it be simply windows telemetry ?
    – yagmoth555
    Feb 9, 2017 at 3:41
  • Telemetry sending data to a single, dynamically assigned IP address in some town in Colorado on port udp/8253 with no references anywhere about it? It seems unlikely, but i modified the registries to disable it. Let's see if it makes any difference.
    – AdiGri
    Feb 9, 2017 at 3:48
  • My suggestion would be to download and run Microsoft Network Monitor (run as administrator) to capture the traffic and associate it with the process responsible for the process (which Microsoft Network Monitor will do). - microsoft.com/en-us/download/details.aspx?id=4865
    – joeqwerty
    Feb 9, 2017 at 5:06

1 Answer 1


Let us see...

The IP address is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24.

A brief look at Google tells me Vitalwerks is the business name of NoIP.com, a dynamic DNS provider.

Have you installed a dynamic DNS update tool, or any other software, from this company? If so, you'll likely find it is the source.

If you have not, then you may find the source is malware. A few years ago, you may recall, Microsoft got a US federal court to authorize an extremely overbroad seizure of noip.com's domains in order to stop a botnet that was using some subdomains.

  • Yes, it was the NoIP dynamic DNS client (installed as a service - NO-IP DUC v4.1.1). I've seen the No-Ip reference for but for some reason I though it was a client of NoIP. Strange that there is no information on udp/8253 about that (but now there is!).
    – AdiGri
    Feb 9, 2017 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .