NHP Server XDP Attack Report
auth-plugin.opennhp.org · 2026-10-14 00:00:02 – 2026-10-14 23:59:59
Methodology
- Attack =
[NHP-DROP];PASSis allowed traffic, shown only as a baseline. - Exact packet totals come from the per-minute
[NHP-STAT]lines (PKTS summed, duplicates removed). - Sampled counts come from per-packet lines, which the filter rate-limits per class; bulk classes may have none. Rankings (IP, geo, port) use sampled events and are not comparable in volume across classes.
- The log has no date per line; dates come from file names.
Overview
Total packets (exact)
36437
Attack (DROP) packets
15 0.04%
Allowed (PASS) packets
36422
Sampled DROP events
15
Sampling rate
100.00%
Unique attack source IPs
11
Private / reserved sources
0
Peak hour
2026-10-14 01:00
Attack types
| Category | Packets (exact) | Share | Sampled events |
|---|---|---|---|
| TCP scan / probe | 12 | 80.00% | 12 |
| Short UDP (below NHP minimum frame) | 3 | 20.00% | 3 |
| Reason | Category | Packets (exact) | Share | Sampled events | Note |
|---|---|---|---|---|---|
TCP_OTHER | TCP scan / probe | 12 | 80.00% | 12 | |
UDP_SHORT | Short UDP (below NHP minimum frame) | 3 | 20.00% | 3 |
Top 20 attack sources (sampled)
| # | IP | Events | Share | Categories | First seen | Last seen | Top dst ports | Location |
|---|---|---|---|---|---|---|---|---|
| 1 | 3.5.89.x | 2 | 13.33% | 1 | 2026-10-14 01:46:25 | 2026-10-14 01:46:25 | 55420 | |
| 2 | 3.5.128.x | 2 | 13.33% | 1 | 2026-10-14 01:46:25 | 2026-10-14 01:46:25 | 33518, 33534 | |
| 3 | 3.5.129.x | 2 | 13.33% | 1 | 2026-10-14 01:46:29 | 2026-10-14 01:46:29 | 52508 | |
| 4 | 52.219.92.x | 2 | 13.33% | 1 | 2026-10-14 01:46:24 | 2026-10-14 01:46:24 | 44192 | |
| 5 | 3.5.128.x | 1 | 6.67% | 1 | 2026-10-14 20:41:27 | 2026-10-14 20:41:27 | 48880 | |
| 6 | 3.5.130.x | 1 | 6.67% | 1 | 2026-10-14 01:46:25 | 2026-10-14 01:46:25 | 49172 | |
| 7 | 3.5.130.x | 1 | 6.67% | 1 | 2026-10-14 01:46:25 | 2026-10-14 01:46:25 | 60394 | |
| 8 | 3.5.131.x | 1 | 6.67% | 1 | 2026-10-14 01:46:24 | 2026-10-14 01:46:24 | 47448 | |
| 9 | 20.55.90.x | 1 | 6.67% | 1 | 2026-10-14 16:38:53 | 2026-10-14 16:38:53 | 443 | |
| 10 | 64.227.90.x | 1 | 6.67% | 1 | 2026-10-14 14:38:50 | 2026-10-14 14:38:50 | 443 | |
| 11 | 159.223.123.x | 1 | 6.67% | 1 | 2026-10-14 02:30:12 | 2026-10-14 02:30:12 | 443 |
Top 20 regions (sampled)
Not enabled (no geo source given). No lookups are performed online.
Top destination ports (sampled)
| Port | Events | Share |
|---|---|---|
443 | 3 | 20.00% |
44192 | 2 | 13.33% |
52508 | 2 | 13.33% |
55420 | 2 | 13.33% |
33518 | 1 | 6.67% |
33534 | 1 | 6.67% |
47448 | 1 | 6.67% |
48880 | 1 | 6.67% |
49172 | 1 | 6.67% |
60394 | 1 | 6.67% |
Protocols (sampled)
| Protocol | Events | Share |
|---|---|---|
| TCP | 12 | 80.00% |
| UDP | 3 | 20.00% |
Trend (exact DROP packets)
| Day | Packets | Share |
|---|---|---|
| 2026-10-14 | 15 | 100.00% |
| Hour | Packets |
|---|---|
| 2026-10-14 01:00 | 11 |
| 2026-10-14 02:00 | 1 |
| 2026-10-14 14:00 | 1 |
| 2026-10-14 16:00 | 1 |
| 2026-10-14 20:00 | 1 |
Data quality
- Unparsable lines: 0
- Duplicate STAT lines ignored: 0
- Scan-detector summary lines (parsed, not part of DROP totals): 0
- IPv6 share of sampled DROP events: 0.00%
- Restarts detected: none