Has anyone monitored various requests from all over the world on Port 17275 via UDP? My firewall logs show huge amounts of such requests from lots of different IP Adresses.

I can't find any documented service which shall use this port. Anyone knows what piece of software may cause these requests?

  • I would suggest posting an example of the log files if your serious about finding anything out about this 'attack' and reading up on how firewalls work – NULLZ Apr 18 '13 at 8:50
  • Thanks for your comment. I was asking for other people who recognized packages on that port, not on how firewalls work. Posting my logs wouldn't be of help I guess - you'll only see iptables logging the drop of such packages from various sources. And I chose the tag attack since I supposed to reach the right people that way - sorry if it was misleading – gue Apr 19 '13 at 8:29
  • 1
    the problem here is that ANY configurable service or malware can use that port. If you don't have anything listening on that port, there's no danger to you. If you want to determine what's going on in a more general/investigative sense, run a packet capture on that interface and see what traffic is trying to connect to that port. You could even try and connect back to the original host, do a port scan and see what services are running on the 'attacking' side. – NULLZ Apr 20 '13 at 3:07

Port 17275 is not registered to any specific service so it can be any application that's configured to listen on that port.

Remember that:

  • Well Known Ports are: 0 through 1023.

  • Registered Ports are: 1024 through 49151.

  • Dynamic/Private are: 49152 through 65535.

Some googling shows that several pieces of malware seem to use this specific port for communications.

  • D3C4FF thanks for proposing an answer. Since I couldn't find anything on google you might want to help me out in finding the right search terms? – gue Apr 19 '13 at 8:32

If it's not anything registered it might very well be a UPnP vulnerability. In this case, a device on a LAN is infected (e.g. a "smart" TV), opens port 17275 on the home router via UPnP (see this answer) and waits for a connection.

I'd suggest setting up a honeypot on that port and listen for what comes in for a starter.

The nice folks at SANS' ISC might be offer you some more advice.


When using IP Telephony you will have excessive use of UDP ports as this carries the voice packets. On Telephony systems you would typically define a range of UDP ports to be used. This range will also have QoS (Quality of Service) applied to them that will prioritize the UDP packets to have the least latency across a data network

  • 2
    Welcome to Information Security. This seems like a guess / clarification required comment to OP. To gain enough reputation to comment on posts, you could try answering other questions. – Jedi Jul 22 '16 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.