NHP Server XDP Attack Report
auth-plugin.opennhp.org · 2026-10-17 00:00:02 – 2026-10-17 23:59:58
Methodology
- Attack =
[NHP-DROP];PASSis allowed traffic, shown only as a baseline. - Exact packet totals come from the per-minute
[NHP-STAT]lines (PKTS summed, duplicates removed). - Sampled counts come from per-packet lines, which the filter rate-limits per class; bulk classes may have none. Rankings (IP, geo, port) use sampled events and are not comparable in volume across classes.
- The log has no date per line; dates come from file names.
Overview
Total packets (exact)
63301
Attack (DROP) packets
24092 38.06%
Allowed (PASS) packets
39209
Sampled DROP events
21792
Sampling rate
90.45%
Unique attack source IPs
5284
Private / reserved sources
0
Peak hour
2026-10-17 19:00
Attack types
| Category | Packets (exact) | Share | Sampled events |
|---|---|---|---|
| TCP SYN scan | 20119 | 83.51% | 18916 |
| TCP to NHP knock port | 2839 | 11.78% | 1750 |
| UDP scan / non-NHP UDP | 677 | 2.81% | 671 |
| SSH probe (non-whitelisted source) | 277 | 1.15% | 275 |
| Other protocol (ICMP etc.) | 149 | 0.62% | 149 |
| TCP scan / probe | 30 | 0.12% | 30 |
| Short UDP (below NHP minimum frame) | 1 | 0.00% | 1 |
| Reason | Category | Packets (exact) | Share | Sampled events | Note |
|---|---|---|---|---|---|
TCP_SYN_SCAN | TCP SYN scan | 20119 | 83.51% | 18916 | |
TCP_NHP_PORT | TCP to NHP knock port | 2839 | 11.78% | 1750 | |
UDP_OTHER | UDP scan / non-NHP UDP | 677 | 2.81% | 671 | |
TCP_SSH_OTHER | SSH probe (non-whitelisted source) | 277 | 1.15% | 275 | |
NON_TCP_UDP | Other protocol (ICMP etc.) | 149 | 0.62% | 149 | |
TCP_OTHER | TCP scan / probe | 30 | 0.12% | 30 | |
UDP_SHORT | Short UDP (below NHP minimum frame) | 1 | 0.00% | 1 |
Top 20 attack sources (sampled)
| # | IP | Events | Share | Categories | First seen | Last seen | Top dst ports | Location |
|---|---|---|---|---|---|---|---|---|
| 1 | 216.180.246.x | 368 | 1.69% | 1 | 2026-10-17 02:20:54 | 2026-10-17 11:25:02 | 6380, 6401, 6421 | |
| 2 | 170.39.216.x | 273 | 1.25% | 2 | 2026-10-17 03:39:34 | 2026-10-17 11:00:59 | 8080, 443, 3000 | |
| 3 | 192.161.49.x | 122 | 0.56% | 1 | 2026-10-17 00:06:06 | 2026-10-17 23:52:38 | 8126, 8127, 8128 | |
| 4 | 24.16.93.x | 96 | 0.44% | 1 | 2026-10-17 00:04:28 | 2026-10-17 23:51:24 | 2323 | |
| 5 | 177.200.124.x | 95 | 0.44% | 1 | 2026-10-17 00:12:01 | 2026-10-17 23:59:22 | 23 | |
| 6 | 181.44.143.x | 92 | 0.42% | 1 | 2026-10-17 00:08:47 | 2026-10-17 23:59:06 | 23 | |
| 7 | 194.180.48.x | 73 | 0.33% | 1 | 2026-10-17 00:26:20 | 2026-10-17 23:59:14 | 0, 17, 28 | |
| 8 | 195.182.16.x | 66 | 0.30% | 1 | 2026-10-17 00:02:33 | 2026-10-17 22:18:52 | 80, 81, 82 | |
| 9 | 85.217.140.x | 60 | 0.28% | 1 | 2026-10-17 00:09:24 | 2026-10-17 23:29:25 | 596, 7474, 8157 | |
| 10 | 85.217.140.x | 59 | 0.27% | 1 | 2026-10-17 00:02:37 | 2026-10-17 23:51:09 | 2371, 7846, 8504 | |
| 11 | 85.217.149.x | 59 | 0.27% | 1 | 2026-10-17 00:11:31 | 2026-10-17 23:52:46 | 9334, 15718, 17236 | |
| 12 | 85.217.140.x | 57 | 0.26% | 1 | 2026-10-17 00:37:34 | 2026-10-17 23:28:39 | 962, 5243, 6986 | |
| 13 | 85.217.149.x | 57 | 0.26% | 2 | 2026-10-17 00:01:27 | 2026-10-17 23:41:43 | 279, 7731, 10675 | |
| 14 | 85.217.149.x | 57 | 0.26% | 1 | 2026-10-17 00:36:11 | 2026-10-17 21:26:00 | 798, 1620, 8706 | |
| 15 | 85.217.140.x | 55 | 0.25% | 2 | 2026-10-17 00:04:56 | 2026-10-17 23:26:19 | 2316, 2827, 4236 | |
| 16 | 85.217.140.x | 55 | 0.25% | 1 | 2026-10-17 00:04:45 | 2026-10-17 23:03:07 | 621, 760, 1511 | |
| 17 | 85.217.140.x | 54 | 0.25% | 1 | 2026-10-17 00:24:12 | 2026-10-17 23:07:12 | 2084, 3493, 3919 | |
| 18 | 85.217.149.x | 54 | 0.25% | 1 | 2026-10-17 00:37:57 | 2026-10-17 23:44:29 | 13151, 13834, 17072 | |
| 19 | 85.217.149.x | 54 | 0.25% | 1 | 2026-10-17 00:50:58 | 2026-10-17 23:28:42 | 3974, 4577, 4700 | |
| 20 | 85.217.140.x | 53 | 0.24% | 1 | 2026-10-17 00:16:05 | 2026-10-17 22:03:41 | 13804, 18443, 22547 |
Top 20 regions (sampled)
Not enabled (no geo source given). No lookups are performed online.
Top destination ports (sampled)
| Port | Events | Share |
|---|---|---|
443 | 1751 | 8.04% |
80 | 1658 | 7.61% |
23 | 490 | 2.25% |
22 | 276 | 1.27% |
8080 | 160 | 0.73% |
0 | 150 | 0.69% |
3389 | 146 | 0.67% |
2323 | 107 | 0.49% |
8000 | 77 | 0.35% |
5060 | 72 | 0.33% |
1723 | 71 | 0.33% |
8888 | 69 | 0.32% |
3000 | 66 | 0.30% |
8443 | 60 | 0.28% |
8081 | 56 | 0.26% |
5000 | 54 | 0.25% |
9000 | 50 | 0.23% |
5900 | 48 | 0.22% |
6379 | 44 | 0.20% |
2222 | 38 | 0.17% |
Protocols (sampled)
| Protocol | Events | Share |
|---|---|---|
| TCP | 20971 | 96.23% |
| UDP | 672 | 3.08% |
| ICMP | 136 | 0.62% |
| GRE | 11 | 0.05% |
| IPv6 | 1 | 0.00% |
| PROTO-4 | 1 | 0.00% |
Trend (exact DROP packets)
| Day | Packets | Share |
|---|---|---|
| 2026-10-17 | 24092 | 100.00% |
| Hour | Packets |
|---|---|
| 2026-10-17 00:00 | 1113 |
| 2026-10-17 01:00 | 994 |
| 2026-10-17 02:00 | 814 |
| 2026-10-17 03:00 | 1028 |
| 2026-10-17 04:00 | 1024 |
| 2026-10-17 05:00 | 975 |
| 2026-10-17 06:00 | 972 |
| 2026-10-17 07:00 | 926 |
| 2026-10-17 08:00 | 903 |
| 2026-10-17 09:00 | 812 |
| 2026-10-17 10:00 | 559 |
| 2026-10-17 11:00 | 739 |
| 2026-10-17 12:00 | 532 |
| 2026-10-17 13:00 | 719 |
| 2026-10-17 14:00 | 789 |
| 2026-10-17 15:00 | 997 |
| 2026-10-17 16:00 | 675 |
| 2026-10-17 17:00 | 759 |
| 2026-10-17 18:00 | 875 |
| 2026-10-17 19:00 | 4537 |
| 2026-10-17 20:00 | 792 |
| 2026-10-17 21:00 | 842 |
| 2026-10-17 22:00 | 877 |
| 2026-10-17 23:00 | 839 |
Data quality
- Unparsable lines: 0
- Duplicate STAT lines ignored: 0
- Scan-detector summary lines (parsed, not part of DROP totals): 11808
- IPv6 share of sampled DROP events: 0.00%
- Restarts detected: none