2

My Company recently got hit by a spam email with a link that executed an .exe file. Apparently our Antivirus stopped it from executing (Symantec enterprise).

I'm no security expert, but I am a computer scientist (with development being my strong suit) so I decided, however, to check the traffic log to look for anything unusual and noticed a gigantic number of UDP requests. Are these normal? It has me a little concerned.

I wanted to analyze the packets with wireshark but I don't have enough privileges, since I'm getting a new laptop so I have a temp one at the time being. When I get mine, what should I look for? Symantec's traffic log

3

This is normal. UDP is sent in bursts, and the small window of time in the screenshot shows a few dozen UDP datagrams in the timespan of one second, which is pretty standard. The answer to how much is too much is simply whenever it is so fast that packets start being dropped.

This UDP is coming externally, whereas a malware threat is internal. Not only was the malware you noticed not executed, but even if it was, it would not result in a burst of incoming traffic, rather you would see it attempt to connect to a C2 (Command and Control) from the inside. UDP is nothing to be scared of. It's a very harmless protocol used for high-speed communication when reliability is not a major concern. It is used in DNS requests, NTP, VPN traffic, video streams, video game traffic, and more. Look on the far right where the destination port and service are specified. Assuming the UDP ports are used for their standard services, the connections are:

  • 1900 - UPnP (Universal Plug N' Play)
  • 5355 - LLMNR (Link-Local Multicast Name Resolution)
  • 5357 - WSDAPI (Web Services or Devices)
  • 67 - DHCP (Dynamic Host Configuration Protocol)

If you are worried that some of these are unintentional, remove the services. None of them are themselves malicious, and the amount of UDP being sent to them is normal.

0

It will depend a lot on the kind of traffic that is there. I can think of several normal reasons for receiving "many" udp packets, like receiving a media stream, or it could even come from a HTTP/2 / SPDY connection.

Based on the port number 68 appearing there, it seems something is using tftp. Which explains the amount of udp traffic, but bears the point of what is doing that, since it's not a commonly used protocol and, given the infection attempt, is something that I would investigate, in case the malware wasn't completely blocked and it was trying to download the next stage payload that way.

  • The destination port is 67, which is DHCP, and far more common than tftp. The source port is 68 because that's how DHCP works. All this is showing is that the system is connected to a router to provide a dynamic IP. It is no tftp in any way. – forest Nov 29 '17 at 2:02
  • @Baal-zebub that would make much more sense. – Ángel Nov 29 '17 at 2:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.