NHP Server XDP Attack Report

auth-plugin.opennhp.org, server.opennhp.org · 2026-10-20 00:00:00 – 2026-10-20 15:14:57

← Back to index

Methodology

Attack = [NHP-DROP]; PASS is allowed traffic, shown only as a baseline.
Exact packet totals come from the per-minute [NHP-STAT] lines (PKTS summed, duplicates removed).
Sampled counts come from per-packet lines, which the filter rate-limits per class; bulk classes may have none. Rankings (IP, geo, port) use sampled events and are not comparable in volume across classes.
The log has no date per line; dates come from file names.

Overview

Total packets (exact)

41750

Attack (DROP) packets

16562 39.67%

Allowed (PASS) packets

25188

Sampled DROP events

14013

Sampling rate

84.61%

Unique attack source IPs

4947

Private / reserved sources

Peak hour

2026-10-20 00:00

Attack types

Category	Packets (exact)	Share	Sampled events
TCP SYN scan	13186	79.62%	11802
TCP to NHP knock port	2581	15.58%	1442
UDP scan / non-NHP UDP	516	3.12%	490
SSH probe (non-whitelisted source)	175	1.06%	175
Other protocol (ICMP etc.)	84	0.51%	84
TCP scan / probe	16	0.10%	16
Short UDP (below NHP minimum frame)	4	0.02%	4

Reason	Category	Packets (exact)	Share	Sampled events
`TCP_SYN_SCAN`	TCP SYN scan	13186	79.62%	11802
`TCP_NHP_PORT`	TCP to NHP knock port	2581	15.58%	1442
`UDP_OTHER`	UDP scan / non-NHP UDP	516	3.12%	490
`TCP_SSH_OTHER`	SSH probe (non-whitelisted source)	175	1.06%	175
`NON_TCP_UDP`	Other protocol (ICMP etc.)	84	0.51%	84
`TCP_OTHER`	TCP scan / probe	16	0.10%	16
`UDP_SHORT`	Short UDP (below NHP minimum frame)	4	0.02%	4

Top 20 attack sources (sampled)

#	IP	Events	Share	Categories	First seen	Last seen	Top dst ports
1	`216.180.246.x`	220	1.57%	1	2026-10-20 09:31:21	2026-10-20 15:11:32	50000, 50001, 50002
2	`104.30.167.x`	127	0.91%	2	2026-10-20 01:13:30	2026-10-20 01:13:52	80, 443
3	`170.39.216.x`	94	0.67%	2	2026-10-20 02:25:30	2026-10-20 02:26:18	80, 5000, 9000
4	`104.30.167.x`	75	0.54%	2	2026-10-20 01:13:38	2026-10-20 01:14:12	80, 443
5	`192.161.49.x`	74	0.53%	1	2026-10-20 00:02:35	2026-10-20 15:14:03	8485, 8486, 8487
6	`181.44.143.x`	57	0.41%	1	2026-10-20 00:04:52	2026-10-20 15:01:41	23
7	`18.116.202.x`	56	0.40%	1	2026-10-20 12:00:19	2026-10-20 12:00:26	113, 8291, 45000
8	`143.110.166.x`	55	0.39%	1	2026-10-20 07:58:02	2026-10-20 07:58:54	443
9	`195.182.16.x`	55	0.39%	1	2026-10-20 00:04:29	2026-10-20 15:05:26	34567, 80, 81
10	`104.28.171.x`	48	0.34%	2	2026-10-20 01:13:48	2026-10-20 01:14:30	80, 443
11	`85.217.149.x`	45	0.32%	1	2026-10-20 00:09:39	2026-10-20 15:14:22	2395, 5486, 17214
12	`85.217.140.x`	44	0.31%	1	2026-10-20 00:10:38	2026-10-20 15:03:32	3303, 7718, 18224
13	`85.217.149.x`	44	0.31%	1	2026-10-20 00:13:15	2026-10-20 15:14:31	1199, 9604, 11699
14	`85.217.140.x`	41	0.29%	1	2026-10-20 01:23:24	2026-10-20 14:57:05	763, 976, 1775
15	`85.217.149.x`	41	0.29%	1	2026-10-20 00:38:25	2026-10-20 14:20:17	3389, 5116, 5910
16	`85.217.149.x`	41	0.29%	1	2026-10-20 00:11:19	2026-10-20 15:07:56	481, 2949, 6245
17	`177.200.124.x`	41	0.29%	1	2026-10-20 00:02:53	2026-10-20 10:18:28	23
18	`85.217.140.x`	40	0.29%	1	2026-10-20 00:04:50	2026-10-20 14:58:27	45, 16921, 19269
19	`85.217.149.x`	40	0.29%	1	2026-10-20 00:44:31	2026-10-20 14:54:01	4531, 6560, 9235
20	`85.217.140.x`	39	0.28%	1	2026-10-20 00:42:48	2026-10-20 14:59:28	7841, 10682, 12983

Top 20 regions (sampled)

Not enabled (no geo source given). No lookups are performed online.

Top destination ports (sampled)

Port	Events	Share
`443`	1446	10.32%
`80`	1399	9.98%
`23`	328	2.34%
`22`	175	1.25%
`0`	84	0.60%
`3389`	69	0.49%
`8080`	68	0.49%
`1723`	52	0.37%
`8443`	49	0.35%
`8888`	46	0.33%
`3000`	38	0.27%
`5060`	34	0.24%
`9000`	34	0.24%
`34567`	32	0.23%
`8000`	28	0.20%
`5000`	27	0.19%
`53`	26	0.19%
`8081`	26	0.19%
`10001`	24	0.17%
`2222`	24	0.17%

Protocols (sampled)

Protocol	Events	Share
TCP	13435	95.88%
UDP	494	3.53%
ICMP	76	0.54%
GRE	6	0.04%
IPv6	1	0.01%
PROTO-4	1	0.01%

Trend (exact DROP packets)

Day	Packets	Share
2026-10-20	16562	100.00%

Hour	Packets
2026-10-20 00:00	4942
2026-10-20 01:00	1304
2026-10-20 02:00	1154
2026-10-20 03:00	927
2026-10-20 04:00	926
2026-10-20 05:00	914
2026-10-20 06:00	724
2026-10-20 07:00	634
2026-10-20 08:00	599
2026-10-20 09:00	637
2026-10-20 10:00	819
2026-10-20 11:00	634
2026-10-20 12:00	835
2026-10-20 13:00	697
2026-10-20 14:00	644
2026-10-20 15:00	172

Data quality

Unparsable lines: 0
Duplicate STAT lines ignored: 0
Scan-detector summary lines (parsed, not part of DROP totals): 7421
IPv6 share of sampled DROP events: 0.00%
Restarts detected (STAT TOTAL went backwards): 3
- 2026-10-20 13:48:56 (PASS/NHP_RELAY TOTAL 26673 -> 4)
- 2026-10-20 14:44:38 (PASS/SSH_RELAY TOTAL 724 -> 677)
- 2026-10-20 15:13:54 (PASS/SSH_RELAY TOTAL 677 -> 660)

Generated offline by endpoints/xdplog-report from the XDP event log. Sampled tables are rate-limited by the filter and may not cover every dropped packet; exact totals come from the STAT lines.