NHP Server XDP Attack Report
auth-plugin.opennhp.org · 2026-10-19 00:00:02 – 2026-10-19 23:59:59
Methodology
- Attack =
[NHP-DROP];PASSis allowed traffic, shown only as a baseline. - Exact packet totals come from the per-minute
[NHP-STAT]lines (PKTS summed, duplicates removed). - Sampled counts come from per-packet lines, which the filter rate-limits per class; bulk classes may have none. Rankings (IP, geo, port) use sampled events and are not comparable in volume across classes.
- The log has no date per line; dates come from file names.
Overview
Total packets (exact)
421424
Attack (DROP) packets
385531 91.48%
Allowed (PASS) packets
35893
Sampled DROP events
170909
Sampling rate
44.33%
Unique attack source IPs
6112
Private / reserved sources
0
Peak hour
2026-10-19 16:00
Attack types
| Category | Packets (exact) | Share | Sampled events |
|---|---|---|---|
| TCP SYN scan | 200413 | 51.98% | 92410 |
| TCP to NHP knock port | 183777 | 47.67% | 77292 |
| UDP scan / non-NHP UDP | 813 | 0.21% | 724 |
| SSH probe (non-whitelisted source) | 279 | 0.07% | 254 |
| Other protocol (ICMP etc.) | 157 | 0.04% | 142 |
| TCP scan / probe | 90 | 0.02% | 85 |
| Short UDP (below NHP minimum frame) | 2 | 0.00% | 2 |
| Reason | Category | Packets (exact) | Share | Sampled events | Note |
|---|---|---|---|---|---|
TCP_SYN_SCAN | TCP SYN scan | 200413 | 51.98% | 92410 | |
TCP_NHP_PORT | TCP to NHP knock port | 183777 | 47.67% | 77292 | |
UDP_OTHER | UDP scan / non-NHP UDP | 813 | 0.21% | 724 | |
TCP_SSH_OTHER | SSH probe (non-whitelisted source) | 279 | 0.07% | 254 | |
NON_TCP_UDP | Other protocol (ICMP etc.) | 157 | 0.04% | 142 | |
TCP_OTHER | TCP scan / probe | 90 | 0.02% | 85 | |
UDP_SHORT | Short UDP (below NHP minimum frame) | 2 | 0.00% | 2 |
Top 20 attack sources (sampled)
| # | IP | Events | Share | Categories | First seen | Last seen | Top dst ports | Location |
|---|---|---|---|---|---|---|---|---|
| 1 | 216.180.246.x | 417 | 0.24% | 1 | 2026-10-19 05:09:55 | 2026-10-19 15:49:36 | 24703, 24797, 25080 | |
| 2 | 168.90.114.x | 232 | 0.14% | 2 | 2026-10-19 14:38:41 | 2026-10-19 23:57:15 | 443, 80 | |
| 3 | 168.90.112.x | 230 | 0.13% | 2 | 2026-10-19 14:38:18 | 2026-10-19 23:59:47 | 80, 443 | |
| 4 | 168.90.113.x | 227 | 0.13% | 2 | 2026-10-19 14:45:15 | 2026-10-19 23:59:24 | 80, 443 | |
| 5 | 168.90.112.x | 225 | 0.13% | 2 | 2026-10-19 14:38:09 | 2026-10-19 23:58:14 | 443, 80 | |
| 6 | 168.90.113.x | 225 | 0.13% | 2 | 2026-10-19 14:41:39 | 2026-10-19 23:59:21 | 443, 80 | |
| 7 | 168.90.115.x | 224 | 0.13% | 2 | 2026-10-19 14:36:45 | 2026-10-19 23:58:15 | 80, 443 | |
| 8 | 168.90.115.x | 224 | 0.13% | 2 | 2026-10-19 14:43:53 | 2026-10-19 23:55:38 | 80, 443 | |
| 9 | 168.90.113.x | 219 | 0.13% | 2 | 2026-10-19 14:36:39 | 2026-10-19 23:58:45 | 443, 80 | |
| 10 | 168.90.115.x | 219 | 0.13% | 2 | 2026-10-19 14:35:52 | 2026-10-19 23:59:24 | 80, 443 | |
| 11 | 168.90.112.x | 218 | 0.13% | 2 | 2026-10-19 14:37:14 | 2026-10-19 23:57:38 | 80, 443 | |
| 12 | 168.90.112.x | 218 | 0.13% | 2 | 2026-10-19 14:37:01 | 2026-10-19 23:59:24 | 80, 443 | |
| 13 | 168.90.115.x | 218 | 0.13% | 2 | 2026-10-19 14:42:08 | 2026-10-19 23:54:56 | 443, 80 | |
| 14 | 168.90.112.x | 217 | 0.13% | 2 | 2026-10-19 14:37:46 | 2026-10-19 23:59:09 | 443, 80 | |
| 15 | 168.90.112.x | 217 | 0.13% | 2 | 2026-10-19 14:36:40 | 2026-10-19 23:59:32 | 443, 80 | |
| 16 | 168.90.112.x | 217 | 0.13% | 2 | 2026-10-19 14:42:21 | 2026-10-19 23:59:19 | 80, 443 | |
| 17 | 168.90.115.x | 217 | 0.13% | 2 | 2026-10-19 14:36:32 | 2026-10-19 23:58:40 | 443, 80 | |
| 18 | 168.90.113.x | 215 | 0.13% | 2 | 2026-10-19 14:38:50 | 2026-10-19 23:55:16 | 443, 80 | |
| 19 | 168.90.112.x | 214 | 0.13% | 2 | 2026-10-19 14:38:02 | 2026-10-19 23:56:47 | 443, 80 | |
| 20 | 168.90.112.x | 214 | 0.13% | 2 | 2026-10-19 14:38:02 | 2026-10-19 23:56:00 | 80, 443 |
Top 20 regions (sampled)
Not enabled (no geo source given). No lookups are performed online.
Top destination ports (sampled)
| Port | Events | Share |
|---|---|---|
80 | 77630 | 45.42% |
443 | 77294 | 45.23% |
23 | 511 | 0.30% |
22 | 255 | 0.15% |
0 | 142 | 0.08% |
8080 | 138 | 0.08% |
3389 | 105 | 0.06% |
5060 | 84 | 0.05% |
1723 | 80 | 0.05% |
8443 | 77 | 0.05% |
6379 | 71 | 0.04% |
8888 | 67 | 0.04% |
5900 | 63 | 0.04% |
3000 | 61 | 0.04% |
5000 | 54 | 0.03% |
8000 | 53 | 0.03% |
9000 | 52 | 0.03% |
53 | 50 | 0.03% |
81 | 46 | 0.03% |
8081 | 43 | 0.03% |
Protocols (sampled)
| Protocol | Events | Share |
|---|---|---|
| TCP | 170041 | 99.49% |
| UDP | 726 | 0.42% |
| ICMP | 131 | 0.08% |
| GRE | 8 | 0.00% |
| ESP | 1 | 0.00% |
| IPv6 | 1 | 0.00% |
| PROTO-4 | 1 | 0.00% |
Trend (exact DROP packets)
| Day | Packets | Share |
|---|---|---|
| 2026-10-19 | 385531 | 100.00% |
| Hour | Packets |
|---|---|
| 2026-10-19 00:00 | 979 |
| 2026-10-19 01:00 | 904 |
| 2026-10-19 02:00 | 944 |
| 2026-10-19 03:00 | 925 |
| 2026-10-19 04:00 | 781 |
| 2026-10-19 05:00 | 686 |
| 2026-10-19 06:00 | 619 |
| 2026-10-19 07:00 | 627 |
| 2026-10-19 08:00 | 779 |
| 2026-10-19 09:00 | 1122 |
| 2026-10-19 10:00 | 762 |
| 2026-10-19 11:00 | 906 |
| 2026-10-19 12:00 | 598 |
| 2026-10-19 13:00 | 759 |
| 2026-10-19 14:00 | 8603 |
| 2026-10-19 15:00 | 40092 |
| 2026-10-19 16:00 | 43102 |
| 2026-10-19 17:00 | 38777 |
| 2026-10-19 18:00 | 40168 |
| 2026-10-19 19:00 | 38628 |
| 2026-10-19 20:00 | 41293 |
| 2026-10-19 21:00 | 39971 |
| 2026-10-19 22:00 | 41516 |
| 2026-10-19 23:00 | 41990 |
Data quality
- Unparsable lines: 0
- Duplicate STAT lines ignored: 0
- Scan-detector summary lines (parsed, not part of DROP totals): 11808
- IPv6 share of sampled DROP events: 0.00%
- Restarts detected: none