Investigating my iptables, I just noticed that I have 122k packets (16MB) sent out of my server. I have no idea what these are since I don’t have any service I’m aware of using udp beside DNS (client) on my server. I have a mail server which I know is a heavy user of udp through dns and rbl.

Is there an easy way to determine if my outgoing udp traffic is legitimate or not ? 

  • 1
    What command are you running to see the UDP and can you include the output? (Just as a wild guess, outbound UDP from a reasonably vanilla server could be NTP or port 123) – SmallClanger Feb 24 '19 at 18:15

Multiple options:

  1. Put some logging in your iptables rules to record allowed udp traffic.
  2. Use wireshark or other packet monitoring tool and make a capture of the udp traffic and analyze it. a. This can be done on the local machine, or
    b. By turning on port-mirroring on a switch and copying the traffic to another port to which a PC with wireshark or similar tool is running to record the traffic. (See SPAN, RSPAN, etc) and looking at the traffic on
  3. If your server connects to a router, make the router log udp traffic allowed for that host. Or possibly netflow if supported.
  4. If your server connects a firewall, make the firewall log the traffic, or possibly netflow if supported. Your firewall might be able to already tell you what connections were established from the server without having to turn on further logging.
  • You may also be able to use a switch to mirror the traffic to a sniffer, e.g. Cisco SPAN, RSPAN, ERSPAN. – Ron Maupin Feb 24 '19 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.