NHP Server XDP Attack Report
auth-plugin.opennhp.org · 2026-10-18 00:00:11 – 2026-10-18 23:59:55
Methodology
- Attack =
[NHP-DROP];PASSis allowed traffic, shown only as a baseline. - Exact packet totals come from the per-minute
[NHP-STAT]lines (PKTS summed, duplicates removed). - Sampled counts come from per-packet lines, which the filter rate-limits per class; bulk classes may have none. Rankings (IP, geo, port) use sampled events and are not comparable in volume across classes.
- The log has no date per line; dates come from file names.
Overview
Total packets (exact)
64668
Attack (DROP) packets
28456 44.00%
Allowed (PASS) packets
36212
Sampled DROP events
23318
Sampling rate
81.94%
Unique attack source IPs
5508
Private / reserved sources
0
Peak hour
2026-10-18 22:00
Attack types
| Category | Packets (exact) | Share | Sampled events |
|---|---|---|---|
| TCP SYN scan | 21492 | 75.53% | 18890 |
| TCP to NHP knock port | 5556 | 19.52% | 3054 |
| UDP scan / non-NHP UDP | 708 | 2.49% | 676 |
| SSH probe (non-whitelisted source) | 441 | 1.55% | 439 |
| Other protocol (ICMP etc.) | 159 | 0.56% | 159 |
| TCP scan / probe | 95 | 0.33% | 95 |
| Short UDP (below NHP minimum frame) | 5 | 0.02% | 5 |
| Reason | Category | Packets (exact) | Share | Sampled events | Note |
|---|---|---|---|---|---|
TCP_SYN_SCAN | TCP SYN scan | 21492 | 75.53% | 18890 | |
TCP_NHP_PORT | TCP to NHP knock port | 5556 | 19.52% | 3054 | |
UDP_OTHER | UDP scan / non-NHP UDP | 708 | 2.49% | 676 | |
TCP_SSH_OTHER | SSH probe (non-whitelisted source) | 441 | 1.55% | 439 | |
NON_TCP_UDP | Other protocol (ICMP etc.) | 159 | 0.56% | 159 | |
TCP_OTHER | TCP scan / probe | 93 | 0.33% | 93 | |
UDP_SHORT | Short UDP (below NHP minimum frame) | 5 | 0.02% | 5 | |
TCP_STEALTH_SCAN | TCP scan / probe | 2 | 0.01% | 2 |
Top 20 attack sources (sampled)
| # | IP | Events | Share | Categories | First seen | Last seen | Top dst ports | Location |
|---|---|---|---|---|---|---|---|---|
| 1 | 62.210.142.x | 478 | 2.05% | 1 | 2026-10-18 02:00:11 | 2026-10-18 09:27:00 | 5523, 5544, 5555 | |
| 2 | 192.161.49.x | 119 | 0.51% | 1 | 2026-10-18 00:05:02 | 2026-10-18 23:54:13 | 8250, 8251, 8252 | |
| 3 | 177.200.124.x | 95 | 0.41% | 1 | 2026-10-18 00:14:22 | 2026-10-18 23:46:07 | 23 | |
| 4 | 67.205.162.x | 94 | 0.40% | 1 | 2026-10-18 13:30:41 | 2026-10-18 13:31:07 | 8562, 8566, 8573 | |
| 5 | 181.44.143.x | 92 | 0.39% | 1 | 2026-10-18 00:15:09 | 2026-10-18 23:50:12 | 23 | |
| 6 | 170.39.216.x | 85 | 0.36% | 2 | 2026-10-18 15:50:30 | 2026-10-18 15:51:15 | 80, 3000, 5000 | |
| 7 | 209.99.187.x | 64 | 0.27% | 2 | 2026-10-18 00:14:50 | 2026-10-18 18:45:32 | 22, 3389 | |
| 8 | 209.99.187.x | 59 | 0.25% | 2 | 2026-10-18 00:01:04 | 2026-10-18 23:17:22 | 443, 80, 25 | |
| 9 | 195.182.16.x | 58 | 0.25% | 1 | 2026-10-18 04:24:45 | 2026-10-18 23:10:49 | 80, 81, 82 | |
| 10 | 209.99.187.x | 56 | 0.24% | 2 | 2026-10-18 00:16:07 | 2026-10-18 20:24:30 | 443, 80, 587 | |
| 11 | 209.99.187.x | 53 | 0.23% | 2 | 2026-10-18 00:49:51 | 2026-10-18 22:23:30 | 80, 443, 587 | |
| 12 | 79.124.40.x | 52 | 0.22% | 1 | 2026-10-18 00:14:23 | 2026-10-18 23:12:20 | 3306, 3309, 3354 | |
| 13 | 194.180.48.x | 52 | 0.22% | 1 | 2026-10-18 00:03:36 | 2026-10-18 23:36:29 | 53, 65, 94 | |
| 14 | 185.224.128.x | 51 | 0.22% | 2 | 2026-10-18 00:07:21 | 2026-10-18 23:52:46 | 1080, 3128, 4145 | |
| 15 | 85.217.140.x | 49 | 0.21% | 1 | 2026-10-18 00:26:40 | 2026-10-18 23:00:48 | 1457, 1981, 2322 | |
| 16 | 85.217.140.x | 49 | 0.21% | 1 | 2026-10-18 00:19:06 | 2026-10-18 23:40:21 | 2749, 3756, 8008 | |
| 17 | 85.217.140.x | 47 | 0.20% | 1 | 2026-10-18 00:27:24 | 2026-10-18 23:38:29 | 14408, 27646, 27840 | |
| 18 | 85.217.149.x | 47 | 0.20% | 1 | 2026-10-18 00:12:53 | 2026-10-18 23:56:33 | 3005, 9774, 14176 | |
| 19 | 85.217.140.x | 46 | 0.20% | 1 | 2026-10-18 00:11:36 | 2026-10-18 23:41:06 | 225, 7737, 9023 | |
| 20 | 85.217.140.x | 46 | 0.20% | 1 | 2026-10-18 00:41:00 | 2026-10-18 23:46:42 | 744, 5985, 8854 |
Top 20 regions (sampled)
Not enabled (no geo source given). No lookups are performed online.
Top destination ports (sampled)
| Port | Events | Share |
|---|---|---|
80 | 3141 | 13.47% |
443 | 3059 | 13.12% |
23 | 593 | 2.54% |
22 | 439 | 1.88% |
0 | 159 | 0.68% |
3389 | 152 | 0.65% |
5900 | 139 | 0.60% |
8080 | 121 | 0.52% |
1723 | 74 | 0.32% |
8443 | 67 | 0.29% |
5060 | 58 | 0.25% |
8000 | 55 | 0.24% |
3000 | 53 | 0.23% |
8888 | 44 | 0.19% |
2222 | 43 | 0.18% |
81 | 43 | 0.18% |
8081 | 39 | 0.17% |
3306 | 38 | 0.16% |
6001 | 37 | 0.16% |
5000 | 36 | 0.15% |
Protocols (sampled)
| Protocol | Events | Share |
|---|---|---|
| TCP | 22478 | 96.40% |
| UDP | 681 | 2.92% |
| ICMP | 148 | 0.63% |
| GRE | 9 | 0.04% |
| IPv6 | 1 | 0.00% |
| PROTO-4 | 1 | 0.00% |
Trend (exact DROP packets)
| Day | Packets | Share |
|---|---|---|
| 2026-10-18 | 28456 | 100.00% |
| Hour | Packets |
|---|---|
| 2026-10-18 00:00 | 893 |
| 2026-10-18 01:00 | 912 |
| 2026-10-18 02:00 | 942 |
| 2026-10-18 03:00 | 960 |
| 2026-10-18 04:00 | 1286 |
| 2026-10-18 05:00 | 1126 |
| 2026-10-18 06:00 | 596 |
| 2026-10-18 07:00 | 609 |
| 2026-10-18 08:00 | 617 |
| 2026-10-18 09:00 | 590 |
| 2026-10-18 10:00 | 568 |
| 2026-10-18 11:00 | 555 |
| 2026-10-18 12:00 | 562 |
| 2026-10-18 13:00 | 717 |
| 2026-10-18 14:00 | 543 |
| 2026-10-18 15:00 | 658 |
| 2026-10-18 16:00 | 530 |
| 2026-10-18 17:00 | 752 |
| 2026-10-18 18:00 | 1626 |
| 2026-10-18 19:00 | 1141 |
| 2026-10-18 20:00 | 1182 |
| 2026-10-18 21:00 | 901 |
| 2026-10-18 22:00 | 9261 |
| 2026-10-18 23:00 | 929 |
Data quality
- Unparsable lines: 0
- Duplicate STAT lines ignored: 0
- Scan-detector summary lines (parsed, not part of DROP totals): 11808
- IPv6 share of sampled DROP events: 0.00%
- Restarts detected: none