NHP Server XDP Attack Report
auth-plugin.opennhp.org · 2026-10-08 00:00:06 – 2026-10-08 23:59:41
Methodology
- Attack =
[NHP-DROP];PASSis allowed traffic, shown only as a baseline. - Exact packet totals come from the per-minute
[NHP-STAT]lines (PKTS summed, duplicates removed). - Sampled counts come from per-packet lines, which the filter rate-limits per class; bulk classes may have none. Rankings (IP, geo, port) use sampled events and are not comparable in volume across classes.
- The log has no date per line; dates come from file names.
Overview
Total packets (exact)
36558
Attack (DROP) packets
11 0.03%
Allowed (PASS) packets
36547
Sampled DROP events
11
Sampling rate
100.00%
Unique attack source IPs
9
Private / reserved sources
0
Peak hour
2026-10-08 10:00
Attack types
| Category | Packets (exact) | Share | Sampled events |
|---|---|---|---|
| Short UDP (below NHP minimum frame) | 7 | 63.64% | 7 |
| TCP scan / probe | 4 | 36.36% | 4 |
| Reason | Category | Packets (exact) | Share | Sampled events | Note |
|---|---|---|---|---|---|
UDP_SHORT | Short UDP (below NHP minimum frame) | 7 | 63.64% | 7 | |
TCP_OTHER | TCP scan / probe | 4 | 36.36% | 4 |
Top 20 attack sources (sampled)
| # | IP | Events | Share | Categories | First seen | Last seen | Top dst ports | Location |
|---|---|---|---|---|---|---|---|---|
| 1 | 18.188.75.x | 2 | 18.18% | 1 | 2026-10-08 05:38:46 | 2026-10-08 06:03:14 | 49476, 56976 | |
| 2 | 104.168.140.x | 2 | 18.18% | 1 | 2026-10-08 10:29:41 | 2026-10-08 10:29:44 | 443 | |
| 3 | 3.5.110.x | 1 | 9.09% | 1 | 2026-10-08 13:21:27 | 2026-10-08 13:21:27 | 44864 | |
| 4 | 3.146.12.x | 1 | 9.09% | 1 | 2026-10-08 04:14:56 | 2026-10-08 04:14:56 | 48354 | |
| 5 | 80.82.77.x | 1 | 9.09% | 1 | 2026-10-08 22:12:35 | 2026-10-08 22:12:35 | 443 | |
| 6 | 91.230.168.x | 1 | 9.09% | 1 | 2026-10-08 10:13:14 | 2026-10-08 10:13:14 | 443 | |
| 7 | 91.231.89.x | 1 | 9.09% | 1 | 2026-10-08 10:24:54 | 2026-10-08 10:24:54 | 443 | |
| 8 | 105.186.77.x | 1 | 9.09% | 1 | 2026-10-08 06:13:30 | 2026-10-08 06:13:30 | 443 | |
| 9 | 189.90.25.x | 1 | 9.09% | 1 | 2026-10-08 15:36:07 | 2026-10-08 15:36:07 | 443 |
Top 20 regions (sampled)
Not enabled (no geo source given). No lookups are performed online.
Top destination ports (sampled)
| Port | Events | Share |
|---|---|---|
443 | 7 | 63.64% |
44864 | 1 | 9.09% |
48354 | 1 | 9.09% |
49476 | 1 | 9.09% |
56976 | 1 | 9.09% |
Protocols (sampled)
| Protocol | Events | Share |
|---|---|---|
| UDP | 7 | 63.64% |
| TCP | 4 | 36.36% |
Trend (exact DROP packets)
| Day | Packets | Share |
|---|---|---|
| 2026-10-08 | 11 | 100.00% |
| Hour | Packets |
|---|---|
| 2026-10-08 04:00 | 1 |
| 2026-10-08 05:00 | 1 |
| 2026-10-08 06:00 | 2 |
| 2026-10-08 10:00 | 4 |
| 2026-10-08 13:00 | 1 |
| 2026-10-08 15:00 | 1 |
| 2026-10-08 22:00 | 1 |
Data quality
- Unparsable lines: 0
- Duplicate STAT lines ignored: 0
- Scan-detector summary lines (parsed, not part of DROP totals): 0
- IPv6 share of sampled DROP events: 0.00%
- Restarts detected (STAT TOTAL went backwards): 3
- 2026-10-08 05:30:55 (PASS/SSH_RELAY TOTAL 388 -> 357)
- 2026-10-08 05:39:34 (PASS/NHP_RELAY TOTAL 22 -> 2)
- 2026-10-08 07:38:13 (PASS/SSH_RELAY TOTAL 1397 -> 383)