NHP Server XDP Attack Report
auth-plugin.opennhp.org · 2026-10-16 00:00:01 – 2026-10-16 23:59:55
Methodology
- Attack =
[NHP-DROP];PASSis allowed traffic, shown only as a baseline. - Exact packet totals come from the per-minute
[NHP-STAT]lines (PKTS summed, duplicates removed). - Sampled counts come from per-packet lines, which the filter rate-limits per class; bulk classes may have none. Rankings (IP, geo, port) use sampled events and are not comparable in volume across classes.
- The log has no date per line; dates come from file names.
Overview
Total packets (exact)
134970
Attack (DROP) packets
89910 66.61%
Allowed (PASS) packets
45060
Sampled DROP events
38840
Sampling rate
43.20%
Unique attack source IPs
7336
Private / reserved sources
0
Peak hour
2026-10-16 18:00
Attack types
| Category | Packets (exact) | Share | Sampled events |
|---|---|---|---|
| TCP SYN scan | 47081 | 52.36% | 21479 |
| TCP to NHP knock port | 42502 | 47.27% | 17065 |
| UDP scan / non-NHP UDP | 175 | 0.19% | 161 |
| SSH probe (non-whitelisted source) | 92 | 0.10% | 84 |
| Other protocol (ICMP etc.) | 32 | 0.04% | 26 |
| TCP scan / probe | 24 | 0.03% | 21 |
| Short UDP (below NHP minimum frame) | 4 | 0.00% | 4 |
| Reason | Category | Packets (exact) | Share | Sampled events | Note |
|---|---|---|---|---|---|
TCP_SYN_SCAN | TCP SYN scan | 47081 | 52.36% | 21479 | |
TCP_NHP_PORT | TCP to NHP knock port | 42502 | 47.27% | 17065 | |
UDP_OTHER | UDP scan / non-NHP UDP | 175 | 0.19% | 161 | |
TCP_SSH_OTHER | SSH probe (non-whitelisted source) | 92 | 0.10% | 84 | |
NON_TCP_UDP | Other protocol (ICMP etc.) | 32 | 0.04% | 26 | |
TCP_OTHER | TCP scan / probe | 24 | 0.03% | 21 | |
UDP_SHORT | Short UDP (below NHP minimum frame) | 4 | 0.00% | 4 |
Top 20 attack sources (sampled)
| # | IP | Events | Share | Categories | First seen | Last seen | Top dst ports | Location |
|---|---|---|---|---|---|---|---|---|
| 1 | 79.120.72.x | 120 | 0.31% | 1 | 2026-10-16 18:18:57 | 2026-10-16 20:10:29 | 5901, 5907, 5943 | |
| 2 | 84.17.60.x | 24 | 0.06% | 1 | 2026-10-16 20:52:12 | 2026-10-16 20:52:46 | 80 | |
| 3 | 146.70.194.x | 24 | 0.06% | 1 | 2026-10-16 22:53:42 | 2026-10-16 22:54:16 | 80 | |
| 4 | 177.200.124.x | 24 | 0.06% | 1 | 2026-10-16 17:41:20 | 2026-10-16 23:56:51 | 23 | |
| 5 | 24.16.93.x | 23 | 0.06% | 1 | 2026-10-16 17:34:02 | 2026-10-16 23:49:32 | 2323 | |
| 6 | 192.161.49.x | 23 | 0.06% | 1 | 2026-10-16 17:42:24 | 2026-10-16 23:56:30 | 8098, 8102, 8103 | |
| 7 | 78.128.114.x | 21 | 0.05% | 1 | 2026-10-16 18:11:28 | 2026-10-16 23:33:52 | 43, 111, 998 | |
| 8 | 89.248.163.x | 21 | 0.05% | 1 | 2026-10-16 17:23:05 | 2026-10-16 22:13:59 | 389, 1443, 2082 | |
| 9 | 181.44.143.x | 21 | 0.05% | 1 | 2026-10-16 17:50:29 | 2026-10-16 23:55:47 | 23 | |
| 10 | 168.227.159.x | 20 | 0.05% | 2 | 2026-10-16 17:39:27 | 2026-10-16 19:22:58 | 80, 443 | |
| 11 | 177.184.68.x | 20 | 0.05% | 2 | 2026-10-16 17:28:01 | 2026-10-16 19:09:10 | 80, 443 | |
| 12 | 177.184.71.x | 20 | 0.05% | 2 | 2026-10-16 17:24:07 | 2026-10-16 19:03:07 | 80, 443 | |
| 13 | 85.217.140.x | 19 | 0.05% | 1 | 2026-10-16 17:48:09 | 2026-10-16 23:57:21 | 1433, 3254, 4029 | |
| 14 | 168.227.156.x | 19 | 0.05% | 2 | 2026-10-16 17:39:24 | 2026-10-16 19:24:33 | 80, 443 | |
| 15 | 168.227.159.x | 19 | 0.05% | 2 | 2026-10-16 17:21:58 | 2026-10-16 19:26:28 | 80, 443 | |
| 16 | 177.184.67.x | 19 | 0.05% | 2 | 2026-10-16 17:24:43 | 2026-10-16 19:07:48 | 443, 80 | |
| 17 | 177.184.68.x | 19 | 0.05% | 2 | 2026-10-16 17:34:12 | 2026-10-16 19:21:05 | 80, 443 | |
| 18 | 177.184.72.x | 19 | 0.05% | 2 | 2026-10-16 17:27:56 | 2026-10-16 19:23:48 | 443, 80 | |
| 19 | 177.184.72.x | 19 | 0.05% | 2 | 2026-10-16 17:26:24 | 2026-10-16 19:23:10 | 443, 80 | |
| 20 | 177.184.75.x | 19 | 0.05% | 2 | 2026-10-16 17:23:54 | 2026-10-16 19:23:16 | 443, 80 |
Top 20 regions (sampled)
Not enabled (no geo source given). No lookups are performed online.
Top destination ports (sampled)
| Port | Events | Share |
|---|---|---|
80 | 17264 | 44.45% |
443 | 17069 | 43.95% |
23 | 107 | 0.28% |
22 | 85 | 0.22% |
3389 | 35 | 0.09% |
8080 | 31 | 0.08% |
2323 | 27 | 0.07% |
0 | 26 | 0.07% |
1723 | 21 | 0.05% |
8081 | 18 | 0.05% |
5432 | 17 | 0.04% |
2222 | 15 | 0.04% |
8888 | 14 | 0.04% |
5000 | 12 | 0.03% |
6379 | 12 | 0.03% |
9000 | 12 | 0.03% |
137 | 11 | 0.03% |
139 | 11 | 0.03% |
110 | 10 | 0.03% |
3000 | 10 | 0.03% |
Protocols (sampled)
| Protocol | Events | Share |
|---|---|---|
| TCP | 38649 | 99.51% |
| UDP | 165 | 0.42% |
| ICMP | 22 | 0.06% |
| GRE | 4 | 0.01% |
Trend (exact DROP packets)
| Day | Packets | Share |
|---|---|---|
| 2026-10-16 | 89910 | 100.00% |
| Hour | Packets |
|---|---|
| 2026-10-16 02:00 | 1 |
| 2026-10-16 09:00 | 1 |
| 2026-10-16 10:00 | 5 |
| 2026-10-16 11:00 | 1 |
| 2026-10-16 13:00 | 1 |
| 2026-10-16 17:00 | 25878 |
| 2026-10-16 18:00 | 41057 |
| 2026-10-16 19:00 | 19535 |
| 2026-10-16 20:00 | 814 |
| 2026-10-16 21:00 | 772 |
| 2026-10-16 22:00 | 1038 |
| 2026-10-16 23:00 | 807 |
Data quality
- Unparsable lines: 0
- Duplicate STAT lines ignored: 0
- Scan-detector summary lines (parsed, not part of DROP totals): 3249
- IPv6 share of sampled DROP events: 0.00%
- Restarts detected (STAT TOTAL went backwards): 1
- 2026-10-16 16:31:40 (PASS/NHP_RELAY TOTAL 24596 -> 2)