UDP traffic

Datagrams matching port:6496 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 1

Latest SIP datagram, to 6496/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-3059551696;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3137356532356533313936300134313935373230313832 Accept: application/sdp User-Agent: Cisco SIP To: "sipvicious"<sip:100@1.1.1.1> Contact

payload bytes

Destination ports

6496/udp SIP1

Networks

AS16276 OVH SAS from 1 source1

Countries

FR France1

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
5.39.125.103	AS16276 OVH SAS	FR	SIP	1	2026-10-05 16:23

Latest datagrams

2026-10-05 16:23:055.39.125.103to 6496/udpSIPFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-3059551696;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333139363001343139353732
payload bytes