Posted on by EvolutionCrazy

Chargen (UDP port 19) – Reflected ddos

Lately I’m seeing chargen service being abused a lot to execute distributed denial of service attacks.
It’s not just “standard ddos”… it’s a reflected ddos with a massive amplification rate!!!
(Amplification rate can be as high as 512x… that means with that just a 100mbit pipe a malicius attacker could easely accomplish a 10gbit+ ddos!)

What is chargen?

From wikipedia:
In the UDP implementation of the protocol, the server sends a UDP datagram containing a random number (between 0 and 512) of characters every time it receives a datagram from the connecting host.

Apparently there’s absolutely no handshake at all with chargen… only the TCP version (obviously) requires handshake…

How are hosts running chargen (UDP) used as botnets?

To execute the attack people are sending spoofed UDP packets with a forged source IP address to hundreds of hosts running chargen (and there are many of them!).
These hosts just reply to the apparent source of such packet as they are intendend to do… the problem is that they are replying to the forged IP address… that host has never requested something to them!

Is my machine vulnerable?

To test if your machine could be exploited just run:

echo t | nc -u X.X.X.X 19

replace X.X.X.X with an IP running chargen… If you got a reply you just found a host that can be used as part of a ddos botnet…

How can I make my machine secure?

disable chargen service:
(please be aware of another weak point of chargen: looks like it can also be used to let machines running chargen attack each-other… guess what happens when you have two chargen sending packets each other with to&from port 19 udp… we got a loop! :D)

if you are running chargen on one of your hosts: CLOSE THAT PORT (IN UDP 19)!
if you are a carrier/ISP that allows spoofed traffic to leave your network: HOPE YOU GET BANKRUPT AND CLOSE YOUR DOORS FOR GOOD!

ktnxbye

read more for additional details and logs

04-july-2012
A lot of Xerox (old?) Phaser printers appeared in a few attacks while being used as bots (chargen udp 19)…

13-july-2012
saw another round of attacks (178hosts totaling 475mbit) full log (CEST time)

Jul 13 17:31:46 SRC=150.145.82.90 LEN=8220 TOS=0x00 PREC=0x00 TTL=55 ID=54233 PROTO=UDP SPT=19 DPT=12627 LEN=8200 
Jul 13 17:31:46 SRC=134.176.28.126 LEN=8220 TOS=0x00 PREC=0x00 TTL=56 ID=30336 PROTO=UDP SPT=19 DPT=12627 LEN=8200 
Jul 13 17:31:46 SRC=213.89.178.243 LEN=3595 TOS=0x00 PREC=0x00 TTL=122 ID=513 PROTO=UDP SPT=19 DPT=12627 LEN=3575 
Jul 13 17:31:46 SRC=150.140.159.77 LEN=4006 TOS=0x00 PREC=0x00 TTL=114 ID=25021 PROTO=UDP SPT=19 DPT=12627 LEN=3986 
Jul 13 17:31:46 SRC=95.160.157.66 LEN=1566 TOS=0x00 PREC=0x00 TTL=124 ID=17972 PROTO=UDP SPT=19 DPT=12627 LEN=1546 
Jul 13 17:31:46 SRC=213.85.143.243 LEN=1855 TOS=0x00 PREC=0x00 TTL=58 ID=8893 PROTO=UDP SPT=19 DPT=12627 LEN=1835 
Jul 13 17:31:46 SRC=213.85.31.50 LEN=5992 TOS=0x00 PREC=0x00 TTL=123 ID=26990 PROTO=UDP SPT=19 DPT=12627 LEN=5972 
Jul 13 17:31:46 SRC=95.140.148.70 LEN=6660 TOS=0x00 PREC=0x00 TTL=122 ID=26964 PROTO=UDP SPT=19 DPT=12627 LEN=6640 
Jul 13 17:31:46 SRC=95.129.118.2 LEN=6937 TOS=0x00 PREC=0x00 TTL=116 ID=5143 PROTO=UDP SPT=19 DPT=12627 LEN=6917 
Jul 13 17:31:46 SRC=134.169.19.15 LEN=8220 TOS=0x00 PREC=0x00 TTL=54 ID=9110 PROTO=UDP SPT=19 DPT=12627 LEN=8200 
Jul 13 17:31:46 SRC=150.140.187.201 LEN=8220 TOS=0x00 PREC=0x00 TTL=50 ID=35740 PROTO=UDP SPT=19 DPT=12627 LEN=8200 
Jul 13 17:31:46 SRC=213.85.49.138 LEN=6384 TOS=0x00 PREC=0x00 TTL=121 ID=38032 PROTO=UDP SPT=19 DPT=12627 LEN=6364 
Jul 13 17:31:46 SRC=95.139.116.106 LEN=1526 TOS=0x00 PREC=0x00 TTL=123 ID=9764 PROTO=UDP SPT=19 DPT=12627 LEN=1506 
Jul 13 17:31:46 SRC=134.147.231.97 LEN=5191 TOS=0x00 PREC=0x00 TTL=119 ID=17666 PROTO=UDP SPT=19 DPT=12627 LEN=5171 
Jul 13 17:31:46 SRC=79.173.86.138 LEN=2168 TOS=0x00 PREC=0x00 TTL=42 ID=5006 PROTO=UDP SPT=19 DPT=12627 LEN=2148 
Jul 13 17:31:46 SRC=64.20.183.37 LEN=2034 TOS=0x00 PREC=0x00 TTL=118 ID=5828 PROTO=UDP SPT=19 DPT=12627 LEN=2014 
Jul 13 17:31:46 SRC=134.147.32.103 LEN=6573 TOS=0x00 PREC=0x00 TTL=119 ID=28045 PROTO=UDP SPT=19 DPT=12627 LEN=6553 
Jul 13 17:31:46 SRC=79.174.68.54 LEN=3987 TOS=0x00 PREC=0x00 TTL=117 ID=12736 PROTO=UDP SPT=19 DPT=12627 LEN=3967 
Jul 13 17:31:46 SRC=213.37.130.176 LEN=2528 TOS=0x00 PREC=0x00 TTL=115 ID=10763 PROTO=UDP SPT=19 DPT=12627 LEN=2508 
Jul 13 17:31:46 SRC=95.76.161.98 LEN=6041 TOS=0x00 PREC=0x00 TTL=121 ID=25900 PROTO=UDP SPT=19 DPT=12627 LEN=6021 
Jul 13 17:31:46 SRC=64.40.242.20 LEN=2255 TOS=0x00 PREC=0x00 TTL=108 ID=20171 PROTO=UDP SPT=19 DPT=12627 LEN=2235 
Jul 13 17:31:46 SRC=79.164.29.234 LEN=4790 TOS=0x00 PREC=0x00 TTL=121 ID=13668 PROTO=UDP SPT=19 DPT=12627 LEN=4770 
Jul 13 17:31:46 SRC=173.248.149.186 LEN=1908 TOS=0x00 PREC=0x00 TTL=119 ID=655 PROTO=UDP SPT=19 DPT=12627 LEN=1888 
Jul 13 17:31:46 SRC=95.77.224.52 LEN=1578 TOS=0x00 PREC=0x00 TTL=121 ID=28998 PROTO=UDP SPT=19 DPT=12627 LEN=1558 
Jul 13 17:31:46 SRC=72.13.83.40 LEN=1722 TOS=0x00 PREC=0x00 TTL=121 ID=3067 PROTO=UDP SPT=19 DPT=12627 LEN=1702 
Jul 13 17:31:46 SRC=184.154.125.114 LEN=1895 TOS=0x00 PREC=0x00 TTL=116 ID=13001 PROTO=UDP SPT=19 DPT=12627 LEN=1875 
Jul 13 17:31:46 SRC=64.38.225.33 LEN=3870 TOS=0x00 PREC=0x00 TTL=120 ID=29444 PROTO=UDP SPT=19 DPT=12627 LEN=3850 
Jul 13 17:31:46 SRC=63.246.141.91 LEN=3297 TOS=0x00 PREC=0x00 TTL=121 ID=2807 PROTO=UDP SPT=19 DPT=12627 LEN=3277 
Jul 13 17:31:46 SRC=173.163.154.177 LEN=1696 TOS=0x00 PREC=0x00 TTL=114 ID=32024 PROTO=UDP SPT=19 DPT=12627 LEN=1676 
Jul 13 17:31:46 SRC=204.249.196.254 LEN=2834 TOS=0x00 PREC=0x00 TTL=108 ID=43652 PROTO=UDP SPT=19 DPT=12627 LEN=2814 
Jul 13 17:31:46 SRC=212.91.32.26 LEN=2390 TOS=0x00 PREC=0x00 TTL=116 ID=31409 PROTO=UDP SPT=19 DPT=12627 LEN=2370 
Jul 13 17:31:47 SRC=212.3.252.169 LEN=2063 TOS=0x00 PREC=0x00 TTL=117 ID=15831 PROTO=UDP SPT=19 DPT=12627 LEN=2043 
Jul 13 17:31:47 SRC=173.193.10.20 LEN=6981 TOS=0x00 PREC=0x00 TTL=117 ID=24366 PROTO=UDP SPT=19 DPT=12627 LEN=6961 
Jul 13 17:31:47 SRC=122.169.240.182 LEN=1710 TOS=0x00 PREC=0x00 TTL=120 ID=8335 PROTO=UDP SPT=19 DPT=12627 LEN=1690 
Jul 13 17:31:47 SRC=173.66.248.100 LEN=1747 TOS=0x00 PREC=0x00 TTL=114 ID=19130 PROTO=UDP SPT=19 DPT=12627 LEN=1727 
Jul 13 17:31:48 SRC=70.38.54.198 LEN=2080 TOS=0x00 PREC=0x00 TTL=115 ID=21652 PROTO=UDP SPT=19 DPT=12627 LEN=2060 
Jul 13 17:31:49 SRC=212.204.212.131 LEN=1998 TOS=0x00 PREC=0x00 TTL=121 ID=34305 PROTO=UDP SPT=19 DPT=12627 LEN=1978 
Jul 13 17:31:49 SRC=84.51.18.163 LEN=2275 TOS=0x00 PREC=0x00 TTL=120 ID=58114 PROTO=UDP SPT=19 DPT=12627 LEN=2255 
Jul 13 17:31:49 SRC=147.91.204.15 LEN=2603 TOS=0x00 PREC=0x00 TTL=113 ID=8083 PROTO=UDP SPT=19 DPT=12627 LEN=2583 
Jul 13 17:31:49 SRC=211.240.16.4 LEN=1827 TOS=0x00 PREC=0x00 TTL=115 ID=4354 PROTO=UDP SPT=19 DPT=12627 LEN=1807 
Jul 13 17:31:50 SRC=70.85.236.66 LEN=2261 TOS=0x00 PREC=0x00 TTL=117 ID=6409 PROTO=UDP SPT=19 DPT=12627 LEN=2241 
Jul 13 17:31:50 SRC=86.122.186.28 LEN=2107 TOS=0x00 PREC=0x00 TTL=56 ID=39778 PROTO=UDP SPT=19 DPT=12627 LEN=2087 
Jul 13 17:31:51 SRC=211.238.203.241 LEN=3010 TOS=0x00 PREC=0x00 TTL=116 ID=6812 PROTO=UDP SPT=19 DPT=12627 LEN=2990 
Jul 13 17:31:51 SRC=173.0.135.168 LEN=5151 TOS=0x00 PREC=0x00 TTL=119 ID=24372 PROTO=UDP SPT=19 DPT=12627 LEN=5131 
Jul 13 17:31:51 SRC=173.201.39.223 LEN=2492 TOS=0x00 PREC=0x00 TTL=118 ID=16061 PROTO=UDP SPT=19 DPT=12627 LEN=2472 
Jul 13 17:31:51 SRC=71.168.106.20 LEN=1573 TOS=0x00 PREC=0x00 TTL=113 ID=15575 PROTO=UDP SPT=19 DPT=12627 LEN=1553 
Jul 13 17:31:51 SRC=173.161.176.235 LEN=1891 TOS=0x00 PREC=0x00 TTL=114 ID=26631 PROTO=UDP SPT=19 DPT=12627 LEN=1871 
Jul 13 17:31:52 SRC=134.106.235.42 LEN=3373 TOS=0x00 PREC=0x00 TTL=117 ID=19085 PROTO=UDP SPT=19 DPT=12627 LEN=3353 
Jul 13 17:31:53 SRC=173.161.54.242 LEN=2108 TOS=0x00 PREC=0x00 TTL=111 ID=44620 PROTO=UDP SPT=19 DPT=12627 LEN=2088 
Jul 13 17:31:53 SRC=94.73.155.34 LEN=3165 TOS=0x00 PREC=0x00 TTL=121 ID=16546 PROTO=UDP SPT=19 DPT=12627 LEN=3145 
Jul 13 17:31:53 SRC=188.124.8.106 LEN=2230 TOS=0x00 PREC=0x00 TTL=117 ID=26213 PROTO=UDP SPT=19 DPT=12627 LEN=2210 
Jul 13 17:31:53 SRC=212.21.97.108 LEN=3092 TOS=0x00 PREC=0x00 TTL=115 ID=8779 PROTO=UDP SPT=19 DPT=12627 LEN=3072 
Jul 13 17:31:54 SRC=212.175.19.210 LEN=1524 TOS=0x00 PREC=0x00 TTL=111 ID=5614 PROTO=UDP SPT=19 DPT=12627 LEN=1504 
Jul 13 17:31:54 SRC=71.6.142.75 LEN=2132 TOS=0x00 PREC=0x00 TTL=110 ID=22048 PROTO=UDP SPT=19 DPT=12627 LEN=2112 
Jul 13 17:31:55 SRC=198.64.249.42 LEN=2307 TOS=0x00 PREC=0x00 TTL=114 ID=9530 PROTO=UDP SPT=19 DPT=12627 LEN=2287 
Jul 13 17:31:55 SRC=82.138.11.114 LEN=2765 TOS=0x00 PREC=0x00 TTL=124 ID=17 PROTO=UDP SPT=19 DPT=12627 LEN=2745 
Jul 13 17:31:55 SRC=108.5.138.2 LEN=1878 TOS=0x00 PREC=0x00 TTL=113 ID=28492 PROTO=UDP SPT=19 DPT=12627 LEN=1858 
Jul 13 17:31:55 SRC=110.234.138.49 LEN=2175 TOS=0x00 PREC=0x00 TTL=118 ID=7967 PROTO=UDP SPT=19 DPT=12627 LEN=2155 
Jul 13 17:31:55 SRC=204.106.240.87 LEN=2363 TOS=0x00 PREC=0x00 TTL=114 ID=8802 PROTO=UDP SPT=19 DPT=12627 LEN=2343 
Jul 13 17:31:56 SRC=147.156.82.209 LEN=1764 TOS=0x00 PREC=0x00 TTL=115 ID=32359 PROTO=UDP SPT=19 DPT=12627 LEN=1744 
Jul 13 17:31:56 SRC=121.101.215.234 LEN=2798 TOS=0x00 PREC=0x00 TTL=108 ID=23158 PROTO=UDP SPT=19 DPT=12627 LEN=2778 
Jul 13 17:31:57 SRC=94.102.11.130 LEN=2399 TOS=0x00 PREC=0x00 TTL=118 ID=20287 PROTO=UDP SPT=19 DPT=12627 LEN=2379 
Jul 13 17:31:57 SRC=199.103.56.161 LEN=2089 TOS=0x00 PREC=0x00 TTL=117 ID=29665 PROTO=UDP SPT=19 DPT=12627 LEN=2069 
Jul 13 17:31:57 SRC=118.194.161.227 LEN=1547 TOS=0x00 PREC=0x00 TTL=106 ID=29647 PROTO=UDP SPT=19 DPT=12627 LEN=1527 
Jul 13 17:31:57 SRC=118.123.11.238 LEN=2100 TOS=0x00 PREC=0x00 TTL=109 ID=22108 PROTO=UDP SPT=19 DPT=12627 LEN=2080 
Jul 13 17:31:57 SRC=95.211.6.65 LEN=1960 TOS=0x00 PREC=0x00 TTL=120 ID=7899 PROTO=UDP SPT=19 DPT=12627 LEN=1940 
Jul 13 17:31:58 SRC=94.247.232.225 LEN=2127 TOS=0x00 PREC=0x00 TTL=119 ID=41997 PROTO=UDP SPT=19 DPT=12627 LEN=2107 
Jul 13 17:31:58 SRC=173.215.169.2 LEN=2440 TOS=0x00 PREC=0x00 TTL=112 ID=8307 PROTO=UDP SPT=19 DPT=12627 LEN=2420 
Jul 13 17:31:59 SRC=120.204.196.157 LEN=2200 TOS=0x00 PREC=0x00 TTL=116 ID=24166 PROTO=UDP SPT=19 DPT=12627 LEN=2180 
Jul 13 17:31:59 SRC=119.26.76.44 LEN=2188 TOS=0x00 PREC=0x00 TTL=112 ID=20697 PROTO=UDP SPT=19 DPT=12627 LEN=2168 
Jul 13 17:31:59 SRC=212.146.137.72 LEN=3908 TOS=0x00 PREC=0x00 TTL=118 ID=23466 PROTO=UDP SPT=19 DPT=12627 LEN=3888 
Jul 13 17:31:59 SRC=94.102.11.147 LEN=4952 TOS=0x00 PREC=0x00 TTL=118 ID=1464 PROTO=UDP SPT=19 DPT=12627 LEN=4932 
Jul 13 17:31:59 SRC=147.94.222.10 LEN=1637 TOS=0x00 PREC=0x00 TTL=116 ID=61521 PROTO=UDP SPT=19 DPT=12627 LEN=1617 
Jul 13 17:31:59 SRC=186.42.102.67 LEN=1600 TOS=0x00 PREC=0x00 TTL=103 ID=16520 PROTO=UDP SPT=19 DPT=12627 LEN=1580 
Jul 13 17:31:59 SRC=173.13.193.75 LEN=1731 TOS=0x00 PREC=0x00 TTL=114 ID=27493 PROTO=UDP SPT=19 DPT=12627 LEN=1711 
Jul 13 17:32:00 SRC=173.255.158.17 LEN=2348 TOS=0x00 PREC=0x00 TTL=117 ID=5675 PROTO=UDP SPT=19 DPT=12627 LEN=2328 
Jul 13 17:32:00 SRC=79.99.248.3 LEN=5213 TOS=0x00 PREC=0x00 TTL=121 ID=25722 PROTO=UDP SPT=19 DPT=12627 LEN=5193 
Jul 13 17:32:02 SRC=212.110.94.72 LEN=2041 TOS=0x00 PREC=0x00 TTL=118 ID=26495 PROTO=UDP SPT=19 DPT=12627 LEN=2021 
Jul 13 17:32:02 SRC=173.193.215.236 LEN=3817 TOS=0x00 PREC=0x00 TTL=120 ID=5358 PROTO=UDP SPT=19 DPT=12627 LEN=3797 
Jul 13 17:32:02 SRC=83.94.100.4 LEN=2038 TOS=0x00 PREC=0x00 TTL=121 ID=63746 PROTO=UDP SPT=19 DPT=12627 LEN=2018 
Jul 13 17:32:03 SRC=212.40.56.82 LEN=2830 TOS=0x00 PREC=0x00 TTL=118 ID=6473 PROTO=UDP SPT=19 DPT=12627 LEN=2810 
Jul 13 17:32:04 SRC=109.87.51.222 LEN=1531 TOS=0x00 PREC=0x00 TTL=123 ID=8917 PROTO=UDP SPT=19 DPT=12627 LEN=1511 
Jul 13 17:32:05 SRC=31.192.213.165 LEN=1893 TOS=0x00 PREC=0x00 TTL=118 ID=17541 PROTO=UDP SPT=19 DPT=12627 LEN=1873 
Jul 13 17:32:05 SRC=212.235.187.60 LEN=3179 TOS=0x00 PREC=0x00 TTL=115 ID=237 PROTO=UDP SPT=19 DPT=12627 LEN=3159 
Jul 13 17:32:05 SRC=195.97.36.50 LEN=2810 TOS=0x00 PREC=0x00 TTL=119 ID=46295 PROTO=UDP SPT=19 DPT=12627 LEN=2790 
Jul 13 17:32:05 SRC=119.6.244.13 LEN=2533 TOS=0x00 PREC=0x00 TTL=47 ID=45409 PROTO=UDP SPT=19 DPT=12627 LEN=2513 
Jul 13 17:32:05 SRC=119.6.106.246 LEN=1946 TOS=0x00 PREC=0x00 TTL=111 ID=15726 PROTO=UDP SPT=19 DPT=12627 LEN=1926 
Jul 13 17:32:05 SRC=142.55.150.30 LEN=4641 TOS=0x00 PREC=0x00 TTL=114 ID=18541 PROTO=UDP SPT=19 DPT=12627 LEN=4621 
Jul 13 17:32:05 SRC=118.244.4.192 LEN=1621 TOS=0x00 PREC=0x00 TTL=101 ID=13777 PROTO=UDP SPT=19 DPT=12627 LEN=1601 
Jul 13 17:32:05 SRC=173.161.0.36 LEN=2263 TOS=0x00 PREC=0x00 TTL=113 ID=39974 PROTO=UDP SPT=19 DPT=12627 LEN=2243 
Jul 13 17:32:05 SRC=212.182.10.89 LEN=5617 TOS=0x00 PREC=0x00 TTL=117 ID=1282 PROTO=UDP SPT=19 DPT=12627 LEN=5597 
Jul 13 17:32:05 SRC=94.231.125.87 LEN=3758 TOS=0x00 PREC=0x00 TTL=122 ID=2508 PROTO=UDP SPT=19 DPT=12627 LEN=3738 
Jul 13 17:32:05 SRC=212.175.136.63 LEN=4018 TOS=0x00 PREC=0x00 TTL=116 ID=27016 PROTO=UDP SPT=19 DPT=12627 LEN=3998 
Jul 13 17:32:05 SRC=63.175.74.15 LEN=4448 TOS=0x00 PREC=0x00 TTL=113 ID=64793 PROTO=UDP SPT=19 DPT=12627 LEN=4428 
Jul 13 17:32:06 SRC=204.152.240.20 LEN=1781 TOS=0x00 PREC=0x00 TTL=114 ID=20665 PROTO=UDP SPT=19 DPT=12627 LEN=1761 
Jul 13 17:32:06 SRC=212.43.238.20 LEN=4972 TOS=0x00 PREC=0x00 TTL=56 ID=22991 PROTO=UDP SPT=19 DPT=12627 LEN=4952 
Jul 13 17:32:06 SRC=173.9.148.4 LEN=1998 TOS=0x00 PREC=0x00 TTL=109 ID=4784 PROTO=UDP SPT=19 DPT=12627 LEN=1978 
Jul 13 17:32:06 SRC=173.212.248.210 LEN=2743 TOS=0x00 PREC=0x00 TTL=120 ID=6987 PROTO=UDP SPT=19 DPT=12627 LEN=2723 
Jul 13 17:32:06 SRC=212.34.152.174 LEN=3806 TOS=0x00 PREC=0x00 TTL=118 ID=27041 PROTO=UDP SPT=19 DPT=12627 LEN=3786 
Jul 13 17:32:06 SRC=212.15.40.159 LEN=1803 TOS=0x00 PREC=0x00 TTL=121 ID=19356 PROTO=UDP SPT=19 DPT=12627 LEN=1783 
Jul 13 17:32:06 SRC=147.230.61.202 LEN=2143 TOS=0x00 PREC=0x00 TTL=120 ID=12149 PROTO=UDP SPT=19 DPT=12627 LEN=2123 
Jul 13 17:32:07 SRC=70.183.24.12 LEN=2600 TOS=0x00 PREC=0x00 TTL=114 ID=26593 PROTO=UDP SPT=19 DPT=12627 LEN=2580 
Jul 13 17:32:07 SRC=31.210.50.74 LEN=1891 TOS=0x00 PREC=0x00 TTL=119 ID=17725 PROTO=UDP SPT=19 DPT=12627 LEN=1871 
Jul 13 17:32:07 SRC=69.243.152.56 LEN=2914 TOS=0x00 PREC=0x00 TTL=112 ID=28217 PROTO=UDP SPT=19 DPT=12627 LEN=2894 
Jul 13 17:32:07 SRC=108.49.250.14 LEN=1835 TOS=0x00 PREC=0x00 TTL=113 ID=1439 PROTO=UDP SPT=19 DPT=12627 LEN=1815 
Jul 13 17:32:07 SRC=69.164.121.152 LEN=3034 TOS=0x00 PREC=0x00 TTL=112 ID=48866 PROTO=UDP SPT=19 DPT=12627 LEN=3014 
Jul 13 17:32:07 SRC=146.164.23.132 LEN=2213 TOS=0x00 PREC=0x00 TTL=114 ID=18255 PROTO=UDP SPT=19 DPT=12627 LEN=2193 
Jul 13 17:32:07 SRC=64.45.86.211 LEN=2341 TOS=0x00 PREC=0x00 TTL=116 ID=6119 PROTO=UDP SPT=19 DPT=12627 LEN=2321 
Jul 13 17:32:08 SRC=79.135.222.93 LEN=2120 TOS=0x00 PREC=0x00 TTL=121 ID=35238 PROTO=UDP SPT=19 DPT=12627 LEN=2100 
Jul 13 17:32:08 SRC=212.236.250.119 LEN=2923 TOS=0x00 PREC=0x00 TTL=122 ID=7914 PROTO=UDP SPT=19 DPT=12627 LEN=2903 
Jul 13 17:32:08 SRC=71.167.148.196 LEN=1933 TOS=0x00 PREC=0x00 TTL=113 ID=2670 PROTO=UDP SPT=19 DPT=12627 LEN=1913 
Jul 13 17:32:08 SRC=111.75.252.158 LEN=2717 TOS=0x00 PREC=0x00 TTL=106 ID=510 PROTO=UDP SPT=19 DPT=12627 LEN=2697 
Jul 13 17:32:08 SRC=119.6.253.8 LEN=3626 TOS=0x00 PREC=0x00 TTL=111 ID=25177 PROTO=UDP SPT=19 DPT=12627 LEN=3606 
Jul 13 17:32:08 SRC=173.161.54.241 LEN=1958 TOS=0x00 PREC=0x00 TTL=112 ID=34379 PROTO=UDP SPT=19 DPT=12627 LEN=1938 
Jul 13 17:32:08 SRC=212.175.22.6 LEN=3042 TOS=0x00 PREC=0x00 TTL=109 ID=20242 PROTO=UDP SPT=19 DPT=12627 LEN=3022 
Jul 13 17:32:08 SRC=79.99.41.28 LEN=1551 TOS=0x00 PREC=0x00 TTL=121 ID=27779 PROTO=UDP SPT=19 DPT=12627 LEN=1531 
Jul 13 17:32:08 SRC=212.174.225.25 LEN=1634 TOS=0x00 PREC=0x00 TTL=119 ID=47363 PROTO=UDP SPT=19 DPT=12627 LEN=1614 
Jul 13 17:32:08 SRC=212.158.142.88 LEN=2404 TOS=0x00 PREC=0x00 TTL=114 ID=20890 PROTO=UDP SPT=19 DPT=12627 LEN=2384 
Jul 13 17:32:08 SRC=189.84.181.76 LEN=1569 TOS=0x00 PREC=0x00 TTL=104 ID=3935 PROTO=UDP SPT=19 DPT=12627 LEN=1549 
Jul 13 17:32:08 SRC=62.219.55.200 LEN=1965 TOS=0x08 PREC=0x00 TTL=113 ID=17816 PROTO=UDP SPT=19 DPT=12627 LEN=1945 
Jul 13 17:32:08 SRC=71.89.132.35 LEN=2958 TOS=0x00 PREC=0x00 TTL=114 ID=24757 PROTO=UDP SPT=19 DPT=12627 LEN=2938 
Jul 13 17:32:09 SRC=83.166.2.186 LEN=4903 TOS=0x00 PREC=0x00 TTL=112 ID=19896 PROTO=UDP SPT=19 DPT=12627 LEN=4883 
Jul 13 17:32:09 SRC=174.5.183.214 LEN=4704 TOS=0x00 PREC=0x00 TTL=118 ID=31938 PROTO=UDP SPT=19 DPT=12627 LEN=4684 
Jul 13 17:32:10 SRC=134.121.132.158 LEN=5076 TOS=0x00 PREC=0x00 TTL=109 ID=38259 PROTO=UDP SPT=19 DPT=12627 LEN=5056 
Jul 13 17:32:11 SRC=198.64.251.14 LEN=1825 TOS=0x00 PREC=0x00 TTL=114 ID=18319 PROTO=UDP SPT=19 DPT=12627 LEN=1805 
Jul 13 17:32:13 SRC=64.27.18.198 LEN=1730 TOS=0x00 PREC=0x00 TTL=116 ID=2189 PROTO=UDP SPT=19 DPT=12627 LEN=1710 
Jul 13 17:32:13 SRC=158.108.54.7 LEN=2997 TOS=0x00 PREC=0x00 TTL=117 ID=9427 PROTO=UDP SPT=19 DPT=12627 LEN=2977 
Jul 13 17:32:13 SRC=210.212.207.172 LEN=1929 TOS=0x00 PREC=0x00 TTL=117 ID=28475 PROTO=UDP SPT=19 DPT=12627 LEN=1909 
Jul 13 17:32:14 SRC=95.168.190.160 LEN=3670 TOS=0x00 PREC=0x00 TTL=117 ID=1385 PROTO=UDP SPT=19 DPT=12627 LEN=3650 
Jul 13 17:32:23 SRC=174.121.5.98 LEN=2014 TOS=0x00 PREC=0x00 TTL=117 ID=12372 PROTO=UDP SPT=19 DPT=12627 LEN=1994 
Jul 13 17:32:26 SRC=70.164.197.88 LEN=2129 TOS=0x00 PREC=0x00 TTL=117 ID=19664 PROTO=UDP SPT=19 DPT=12627 LEN=2109 
Jul 13 17:32:30 SRC=211.81.72.10 LEN=1721 TOS=0x00 PREC=0x00 TTL=109 ID=22853 PROTO=UDP SPT=19 DPT=12627 LEN=1701 
Jul 13 17:32:43 SRC=210.202.197.230 LEN=2193 TOS=0x00 PREC=0x00 TTL=108 ID=194 PROTO=UDP SPT=19 DPT=12627 LEN=2173 
Jul 13 17:32:46 SRC=122.115.33.51 LEN=6187 TOS=0x00 PREC=0x00 TTL=103 ID=22542 PROTO=UDP SPT=19 DPT=12627 LEN=6167 
Jul 13 17:32:46 SRC=58.119.86.2 LEN=4720 TOS=0x00 PREC=0x00 TTL=102 ID=8583 PROTO=UDP SPT=19 DPT=12627 LEN=4700 
Jul 13 17:32:46 SRC=122.115.60.194 LEN=5694 TOS=0x00 PREC=0x00 TTL=105 ID=4118 PROTO=UDP SPT=19 DPT=12627 LEN=5674 
Jul 13 17:32:46 SRC=221.1.107.244 LEN=2800 TOS=0x00 PREC=0x00 TTL=111 ID=25124 PROTO=UDP SPT=19 DPT=12627 LEN=2780 
Jul 13 17:32:46 SRC=58.56.108.71 LEN=2112 TOS=0x00 PREC=0x00 TTL=105 ID=448 PROTO=UDP SPT=19 DPT=12627 LEN=2092 
Jul 13 17:32:46 SRC=58.83.131.91 LEN=2915 TOS=0x00 PREC=0x00 TTL=105 ID=23012 PROTO=UDP SPT=19 DPT=12627 LEN=2895 
Jul 13 17:32:46 SRC=211.208.81.99 LEN=3642 TOS=0x00 PREC=0x00 TTL=116 ID=61348 PROTO=UDP SPT=19 DPT=12627 LEN=3622 
Jul 13 17:32:46 SRC=58.56.90.132 LEN=2017 TOS=0x00 PREC=0x00 TTL=44 ID=31067 PROTO=UDP SPT=19 DPT=12627 LEN=1997 
Jul 13 17:32:47 SRC=58.120.224.115 LEN=1671 TOS=0x00 PREC=0x00 TTL=118 ID=15424 PROTO=UDP SPT=19 DPT=12627 LEN=1651 
Jul 13 17:32:47 SRC=58.40.18.73 LEN=2900 TOS=0x00 PREC=0x00 TTL=106 ID=292 PROTO=UDP SPT=19 DPT=12627 LEN=2880 
Jul 13 17:32:47 SRC=58.67.156.94 LEN=1919 TOS=0x00 PREC=0x00 TTL=105 ID=29435 PROTO=UDP SPT=19 DPT=12627 LEN=1899 
Jul 13 17:32:47 SRC=58.57.39.27 LEN=1595 TOS=0x00 PREC=0x00 TTL=106 ID=21378 PROTO=UDP SPT=19 DPT=12627 LEN=1575 
Jul 13 17:32:47 SRC=211.206.123.146 LEN=4483 TOS=0x00 PREC=0x00 TTL=114 ID=1311 PROTO=UDP SPT=19 DPT=12627 LEN=4463 
Jul 13 17:32:47 SRC=58.61.37.217 LEN=4185 TOS=0x00 PREC=0x00 TTL=45 ID=5050 PROTO=UDP SPT=19 DPT=12627 LEN=4165 
Jul 13 17:32:47 SRC=58.42.229.25 LEN=3845 TOS=0x00 PREC=0x00 TTL=109 ID=15467 PROTO=UDP SPT=19 DPT=12627 LEN=3825 
Jul 13 17:32:47 SRC=186.113.28.131 LEN=2581 TOS=0x00 PREC=0x00 TTL=112 ID=31314 PROTO=UDP SPT=19 DPT=12627 LEN=2561 
Jul 13 17:32:47 SRC=125.212.35.125 LEN=6779 TOS=0x00 PREC=0x00 TTL=115 ID=28474 PROTO=UDP SPT=19 DPT=12627 LEN=6759 
Jul 13 17:32:47 SRC=71.46.66.40 LEN=2990 TOS=0x00 PREC=0x00 TTL=111 ID=41027 PROTO=UDP SPT=19 DPT=12627 LEN=2970 
Jul 13 17:32:47 SRC=83.229.6.131 LEN=4584 TOS=0x00 PREC=0x00 TTL=117 ID=31728 PROTO=UDP SPT=19 DPT=12627 LEN=4564 
Jul 13 17:32:47 SRC=186.91.238.167 LEN=2074 TOS=0x00 PREC=0x00 TTL=109 ID=27140 PROTO=UDP SPT=19 DPT=12627 LEN=2054 
Jul 13 17:32:47 SRC=118.123.6.25 LEN=2309 TOS=0x00 PREC=0x00 TTL=109 ID=6549 PROTO=UDP SPT=19 DPT=12627 LEN=2289 
Jul 13 17:32:47 SRC=122.165.28.163 LEN=3449 TOS=0x00 PREC=0x00 TTL=119 ID=17677 PROTO=UDP SPT=19 DPT=12627 LEN=3429 
Jul 13 17:32:47 SRC=173.196.8.28 LEN=6092 TOS=0x00 PREC=0x00 TTL=113 ID=16191 PROTO=UDP SPT=19 DPT=12627 LEN=6072 
Jul 13 17:32:47 SRC=83.249.27.191 LEN=1683 TOS=0x00 PREC=0x00 TTL=122 ID=28794 PROTO=UDP SPT=19 DPT=12627 LEN=1663 
Jul 13 17:32:47 SRC=70.72.175.144 LEN=2540 TOS=0x00 PREC=0x00 TTL=117 ID=23796 PROTO=UDP SPT=19 DPT=12627 LEN=2520 
Jul 13 17:32:47 SRC=173.217.163.165 LEN=3428 TOS=0x00 PREC=0x00 TTL=117 ID=17599 PROTO=UDP SPT=19 DPT=12627 LEN=3408 
Jul 13 17:32:47 SRC=70.161.174.18 LEN=2136 TOS=0x00 PREC=0x00 TTL=118 ID=13221 PROTO=UDP SPT=19 DPT=12627 LEN=2116 
Jul 13 17:32:47 SRC=180.218.203.148 LEN=2372 TOS=0x00 PREC=0x00 TTL=107 ID=57705 PROTO=UDP SPT=19 DPT=12627 LEN=2352 
Jul 13 17:32:47 SRC=71.95.107.241 LEN=2995 TOS=0x00 PREC=0x00 TTL=110 ID=36551 PROTO=UDP SPT=19 DPT=12627 LEN=2975 
Jul 13 17:32:48 SRC=199.119.204.88 LEN=4902 TOS=0x00 PREC=0x00 TTL=120 ID=4690 PROTO=UDP SPT=19 DPT=12627 LEN=4882 
Jul 13 17:32:48 SRC=96.53.197.41 LEN=1914 TOS=0x00 PREC=0x00 TTL=116 ID=2714 PROTO=UDP SPT=19 DPT=12627 LEN=1894 
Jul 13 17:32:48 SRC=173.81.22.61 LEN=2399 TOS=0x00 PREC=0x00 TTL=119 ID=5872 PROTO=UDP SPT=19 DPT=12627 LEN=2379 
Jul 13 17:32:48 SRC=173.185.176.98 LEN=1826 TOS=0x00 PREC=0x00 TTL=109 ID=6624 PROTO=UDP SPT=19 DPT=12627 LEN=1806 
Jul 13 17:32:48 SRC=70.178.209.23 LEN=4087 TOS=0x00 PREC=0x00 TTL=114 ID=2111 PROTO=UDP SPT=19 DPT=12627 LEN=4067 
Jul 13 17:32:49 SRC=173.26.71.224 LEN=5625 TOS=0x00 PREC=0x00 TTL=111 ID=14248 PROTO=UDP SPT=19 DPT=12627 LEN=5605 
Jul 13 17:32:49 SRC=196.207.30.94 LEN=1721 TOS=0x00 PREC=0x00 TTL=117 ID=9653 PROTO=UDP SPT=19 DPT=12627 LEN=1701 
Jul 13 17:32:49 SRC=186.23.23.88 LEN=1758 TOS=0x00 PREC=0x00 TTL=47 ID=2873 PROTO=UDP SPT=19 DPT=12627 LEN=1738 
Jul 13 17:32:50 SRC=173.80.80.149 LEN=1729 TOS=0x00 PREC=0x00 TTL=117 ID=6379 PROTO=UDP SPT=19 DPT=12627 LEN=1709 
Jul 13 17:32:51 SRC=84.18.134.235 LEN=2162 TOS=0x00 PREC=0x00 TTL=124 ID=17517 PROTO=UDP SPT=19 DPT=12627 LEN=2142 
Jul 13 17:32:51 SRC=95.171.77.88 LEN=2149 TOS=0x00 PREC=0x00 TTL=55 ID=50051 PROTO=UDP SPT=19 DPT=12627 LEN=2129 
Jul 13 17:32:52 SRC=70.41.6.78 LEN=2178 TOS=0x00 PREC=0x00 TTL=107 ID=5277 PROTO=UDP SPT=19 DPT=12627 LEN=2158 
Jul 13 17:32:54 SRC=83.163.194.68 LEN=4426 TOS=0x00 PREC=0x00 TTL=120 ID=13064 PROTO=UDP SPT=19 DPT=12627 LEN=4406 
Jul 13 17:32:54 SRC=71.97.87.95 LEN=1881 TOS=0x00 PREC=0x00 TTL=46 ID=60765 PROTO=UDP SPT=19 DPT=12627 LEN=1861 
Jul 13 17:32:56 SRC=71.21.146.57 LEN=3479 TOS=0x00 PREC=0x00 TTL=117 ID=6686 PROTO=UDP SPT=19 DPT=12627 LEN=3459 
Jul 13 17:33:22 SRC=159.149.69.204 LEN=2045 TOS=0x00 PREC=0x00 TTL=118 ID=48964 PROTO=UDP SPT=19 DPT=12627 LEN=2025

28-august-2012
another day, another attack (376hosts) full log (CEST time)

Aug 29 23:19:59 SRC=78.109.27.193 LEN=6343 TOS=0x00 PREC=0x00 TTL=122 ID=30126 PROTO=UDP SPT=19 DPT=1417 LEN=6323 
Aug 29 23:19:59 SRC=77.238.20.77 LEN=2197 TOS=0x00 PREC=0x00 TTL=113 ID=7053 PROTO=UDP SPT=19 DPT=1417 LEN=2177 
Aug 29 23:19:59 SRC=178.211.50.96 LEN=1883 TOS=0x00 PREC=0x00 TTL=120 ID=24983 PROTO=UDP SPT=19 DPT=1417 LEN=1863 
Aug 29 23:19:59 SRC=78.40.229.123 LEN=4666 TOS=0x00 PREC=0x00 TTL=113 ID=22660 PROTO=UDP SPT=19 DPT=1417 LEN=4646 
Aug 29 23:19:59 SRC=77.48.91.6 LEN=6616 TOS=0x00 PREC=0x00 TTL=112 ID=56375 PROTO=UDP SPT=19 DPT=1417 LEN=6596 
Aug 29 23:19:59 SRC=77.221.132.131 LEN=6017 TOS=0x00 PREC=0x00 TTL=122 ID=9591 PROTO=UDP SPT=19 DPT=1417 LEN=5997 
Aug 29 23:19:59 SRC=129.10.155.75 LEN=4629 TOS=0x00 PREC=0x00 TTL=116 ID=23528 PROTO=UDP SPT=19 DPT=1417 LEN=4609 
Aug 29 23:19:59 SRC=76.164.129.1 LEN=2476 TOS=0x00 PREC=0x00 TTL=113 ID=7277 PROTO=UDP SPT=19 DPT=1417 LEN=2456 
Aug 29 23:19:59 SRC=128.95.41.2 LEN=8220 TOS=0x00 PREC=0x00 TTL=50 ID=38794 PROTO=UDP SPT=19 DPT=1417 LEN=8200 
Aug 29 23:19:59 SRC=176.53.34.10 LEN=3609 TOS=0x00 PREC=0x00 TTL=121 ID=4943 PROTO=UDP SPT=19 DPT=1417 LEN=3589 
Aug 29 23:19:59 SRC=75.125.199.226 LEN=4617 TOS=0x00 PREC=0x00 TTL=115 ID=5177 PROTO=UDP SPT=19 DPT=1417 LEN=4597 
Aug 29 23:19:59 SRC=74.200.201.226 LEN=5457 TOS=0x00 PREC=0x00 TTL=114 ID=30032 PROTO=UDP SPT=19 DPT=1417 LEN=5437 
Aug 29 23:19:59 SRC=74.81.77.60 LEN=5501 TOS=0x00 PREC=0x00 TTL=114 ID=30290 PROTO=UDP SPT=19 DPT=1417 LEN=5481 
Aug 29 23:19:59 SRC=74.86.163.66 LEN=2059 TOS=0x00 PREC=0x00 TTL=117 ID=4595 PROTO=UDP SPT=19 DPT=1417 LEN=2039 
Aug 29 23:19:59 SRC=174.142.61.170 LEN=5749 TOS=0x00 PREC=0x00 TTL=118 ID=11240 PROTO=UDP SPT=19 DPT=1417 LEN=5729 
Aug 29 23:19:59 SRC=72.55.156.183 LEN=5689 TOS=0x00 PREC=0x00 TTL=117 ID=3295 PROTO=UDP SPT=19 DPT=1417 LEN=5669 
Aug 29 23:19:59 SRC=74.54.58.186 LEN=1998 TOS=0x00 PREC=0x00 TTL=116 ID=18911 PROTO=UDP SPT=19 DPT=1417 LEN=1978 
Aug 29 23:19:59 SRC=74.114.48.15 LEN=6521 TOS=0x00 PREC=0x00 TTL=53 ID=593 PROTO=UDP SPT=19 DPT=1417 LEN=6501 
Aug 29 23:19:59 SRC=72.55.179.133 LEN=6235 TOS=0x00 PREC=0x00 TTL=118 ID=9424 PROTO=UDP SPT=19 DPT=1417 LEN=6215 
Aug 29 23:19:59 SRC=72.10.208.8 LEN=6596 TOS=0x00 PREC=0x00 TTL=116 ID=33822 PROTO=UDP SPT=19 DPT=1417 LEN=6576 
Aug 29 23:19:59 SRC=74.3.209.202 LEN=6305 TOS=0x00 PREC=0x00 TTL=111 ID=2814 PROTO=UDP SPT=19 DPT=1417 LEN=6285 
Aug 29 23:19:59 SRC=184.173.183.146 LEN=1630 TOS=0x00 PREC=0x00 TTL=116 ID=24955 PROTO=UDP SPT=19 DPT=1417 LEN=1610 
Aug 29 23:19:59 SRC=174.37.231.118 LEN=6984 TOS=0x00 PREC=0x00 TTL=118 ID=24808 PROTO=UDP SPT=19 DPT=1417 LEN=6964 
Aug 29 23:19:59 SRC=173.212.248.210 LEN=5458 TOS=0x00 PREC=0x00 TTL=119 ID=17749 PROTO=UDP SPT=19 DPT=1417 LEN=5438 
Aug 29 23:19:59 SRC=72.93.243.210 LEN=5996 TOS=0x00 PREC=0x00 TTL=33 ID=28508 PROTO=UDP SPT=19 DPT=1417 LEN=5976 
Aug 29 23:20:00 SRC=174.128.234.66 LEN=4937 TOS=0x00 PREC=0x00 TTL=118 ID=8191 PROTO=UDP SPT=19 DPT=1417 LEN=4917 
Aug 29 23:20:00 SRC=174.37.93.101 LEN=2189 TOS=0x00 PREC=0x00 TTL=117 ID=18389 PROTO=UDP SPT=19 DPT=1417 LEN=2169 
Aug 29 23:20:00 SRC=72.167.253.124 LEN=4636 TOS=0x00 PREC=0x00 TTL=117 ID=24986 PROTO=UDP SPT=19 DPT=1417 LEN=4616 
Aug 29 23:20:00 SRC=72.167.141.76 LEN=5443 TOS=0x00 PREC=0x00 TTL=118 ID=15626 PROTO=UDP SPT=19 DPT=1417 LEN=5423 
Aug 29 23:20:00 SRC=173.66.248.100 LEN=3332 TOS=0x00 PREC=0x00 TTL=114 ID=15587 PROTO=UDP SPT=19 DPT=1417 LEN=3312 
Aug 29 23:20:00 SRC=174.139.51.114 LEN=3245 TOS=0x00 PREC=0x00 TTL=118 ID=29560 PROTO=UDP SPT=19 DPT=1417 LEN=3225 
Aug 29 23:20:00 SRC=70.38.78.233 LEN=3669 TOS=0x00 PREC=0x00 TTL=118 ID=2318 PROTO=UDP SPT=19 DPT=1417 LEN=3649 
Aug 29 23:20:00 SRC=24.173.180.212 LEN=1801 TOS=0x00 PREC=0x40 TTL=108 ID=7555 PROTO=UDP SPT=19 DPT=1417 LEN=1781 
Aug 29 23:20:00 SRC=173.201.39.223 LEN=3030 TOS=0x00 PREC=0x00 TTL=118 ID=21807 PROTO=UDP SPT=19 DPT=1417 LEN=3010 
Aug 29 23:20:00 SRC=173.215.169.2 LEN=4051 TOS=0x00 PREC=0x00 TTL=113 ID=22168 PROTO=UDP SPT=19 DPT=1417 LEN=4031 
Aug 29 23:20:00 SRC=173.74.246.20 LEN=5945 TOS=0x00 PREC=0x00 TTL=110 ID=21795 PROTO=UDP SPT=19 DPT=1417 LEN=5925 
Aug 29 23:20:00 SRC=173.10.202.19 LEN=2530 TOS=0x00 PREC=0x00 TTL=111 ID=7174 PROTO=UDP SPT=19 DPT=1417 LEN=2510 
Aug 29 23:20:00 SRC=173.0.140.20 LEN=6014 TOS=0x00 PREC=0x00 TTL=116 ID=7877 PROTO=UDP SPT=19 DPT=1417 LEN=5994 
Aug 29 23:20:00 SRC=70.88.239.165 LEN=2385 TOS=0x00 PREC=0x00 TTL=113 ID=9408 PROTO=UDP SPT=19 DPT=1417 LEN=2365 
Aug 29 23:20:00 SRC=173.1.26.51 LEN=4329 TOS=0x00 PREC=0x00 TTL=111 ID=24064 PROTO=UDP SPT=19 DPT=1417 LEN=4309 
Aug 29 23:20:00 SRC=70.88.38.66 LEN=5543 TOS=0x00 PREC=0x00 TTL=110 ID=21096 PROTO=UDP SPT=19 DPT=1417 LEN=5523 
Aug 29 23:20:00 SRC=61.8.0.111 LEN=2307 TOS=0x00 PREC=0x00 TTL=111 ID=53 PROTO=UDP SPT=19 DPT=1417 LEN=2287 
Aug 29 23:20:00 SRC=70.90.71.92 LEN=2755 TOS=0x00 PREC=0x00 TTL=109 ID=8823 PROTO=UDP SPT=19 DPT=1417 LEN=2735 
Aug 29 23:20:00 SRC=69.46.139.176 LEN=3317 TOS=0x00 PREC=0x00 TTL=113 ID=33132 PROTO=UDP SPT=19 DPT=1417 LEN=3297 
Aug 29 23:20:00 SRC=69.60.127.209 LEN=2349 TOS=0x00 PREC=0x00 TTL=113 ID=424 PROTO=UDP SPT=19 DPT=1417 LEN=2329 
Aug 29 23:20:00 SRC=69.28.71.245 LEN=4760 TOS=0x00 PREC=0x00 TTL=111 ID=16928 PROTO=UDP SPT=19 DPT=1417 LEN=4740 
Aug 29 23:20:00 SRC=69.46.139.136 LEN=4236 TOS=0x00 PREC=0x00 TTL=49 ID=4908 PROTO=UDP SPT=19 DPT=1417 LEN=4216 
Aug 29 23:20:00 SRC=70.88.19.106 LEN=4257 TOS=0x00 PREC=0x00 TTL=111 ID=9100 PROTO=UDP SPT=19 DPT=1417 LEN=4237 
Aug 29 23:20:00 SRC=69.41.170.182 LEN=2020 TOS=0x00 PREC=0x00 TTL=107 ID=21894 PROTO=UDP SPT=19 DPT=1417 LEN=2000 
Aug 29 23:20:00 SRC=69.13.35.114 LEN=6103 TOS=0x00 PREC=0x00 TTL=111 ID=32008 PROTO=UDP SPT=19 DPT=1417 LEN=6083 
Aug 29 23:20:00 SRC=68.233.226.82 LEN=6471 TOS=0x00 PREC=0x00 TTL=111 ID=4878 PROTO=UDP SPT=19 DPT=1417 LEN=6451 
Aug 29 23:20:00 SRC=64.151.88.92 LEN=3874 TOS=0x00 PREC=0x00 TTL=111 ID=3934 PROTO=UDP SPT=19 DPT=1417 LEN=3854 
Aug 29 23:20:00 SRC=208.96.50.52 LEN=2852 TOS=0x00 PREC=0x00 TTL=111 ID=22469 PROTO=UDP SPT=19 DPT=1417 LEN=2832 
Aug 29 23:20:00 SRC=216.121.7.236 LEN=6870 TOS=0x00 PREC=0x00 TTL=111 ID=3094 PROTO=UDP SPT=19 DPT=1417 LEN=6850 
Aug 29 23:20:00 SRC=68.233.252.250 LEN=6353 TOS=0x00 PREC=0x00 TTL=111 ID=5868 PROTO=UDP SPT=19 DPT=1417 LEN=6333 
Aug 29 23:20:00 SRC=69.59.168.52 LEN=6825 TOS=0x00 PREC=0x00 TTL=111 ID=32558 PROTO=UDP SPT=19 DPT=1417 LEN=6805 
Aug 29 23:20:00 SRC=64.151.104.52 LEN=6468 TOS=0x00 PREC=0x00 TTL=111 ID=15730 PROTO=UDP SPT=19 DPT=1417 LEN=6448 
Aug 29 23:20:00 SRC=69.90.184.207 LEN=3149 TOS=0x00 PREC=0x00 TTL=120 ID=32428 PROTO=UDP SPT=19 DPT=1417 LEN=3129 
Aug 29 23:20:00 SRC=216.93.187.100 LEN=3723 TOS=0x00 PREC=0x00 TTL=111 ID=8612 PROTO=UDP SPT=19 DPT=1417 LEN=3703 
Aug 29 23:20:00 SRC=64.151.71.132 LEN=5881 TOS=0x00 PREC=0x00 TTL=111 ID=26193 PROTO=UDP SPT=19 DPT=1417 LEN=5861 
Aug 29 23:20:00 SRC=216.121.7.228 LEN=6153 TOS=0x00 PREC=0x00 TTL=111 ID=17399 PROTO=UDP SPT=19 DPT=1417 LEN=6133 
Aug 29 23:20:00 SRC=69.25.218.6 LEN=3339 TOS=0x00 PREC=0x00 TTL=109 ID=41486 PROTO=UDP SPT=19 DPT=1417 LEN=3319 
Aug 29 23:20:00 SRC=123.141.146.170 LEN=2270 TOS=0x00 PREC=0x00 TTL=105 ID=62773 PROTO=UDP SPT=19 DPT=1417 LEN=2250 
Aug 29 23:20:00 SRC=68.64.245.130 LEN=4915 TOS=0x00 PREC=0x00 TTL=117 ID=25149 PROTO=UDP SPT=19 DPT=1417 LEN=4895 
Aug 29 23:20:00 SRC=68.71.146.126 LEN=2645 TOS=0x00 PREC=0x00 TTL=118 ID=12426 PROTO=UDP SPT=19 DPT=1417 LEN=2625 
Aug 29 23:20:00 SRC=123.100.231.166 LEN=5078 TOS=0x00 PREC=0x00 TTL=112 ID=26473 PROTO=UDP SPT=19 DPT=1417 LEN=5058 
Aug 29 23:20:00 SRC=72.18.141.131 LEN=2438 TOS=0x00 PREC=0x00 TTL=118 ID=32310 PROTO=UDP SPT=19 DPT=1417 LEN=2418 
Aug 29 23:20:00 SRC=68.68.204.7 LEN=6437 TOS=0x00 PREC=0x00 TTL=107 ID=23517 PROTO=UDP SPT=19 DPT=1417 LEN=6417 
Aug 29 23:20:00 SRC=64.150.182.81 LEN=1643 TOS=0x00 PREC=0x00 TTL=117 ID=22459 PROTO=UDP SPT=19 DPT=1417 LEN=1623 
Aug 29 23:20:00 SRC=208.109.122.47 LEN=3049 TOS=0x00 PREC=0x00 TTL=118 ID=1125 PROTO=UDP SPT=19 DPT=1417 LEN=3029 
Aug 29 23:20:00 SRC=123.232.122.167 LEN=6661 TOS=0x00 PREC=0x00 TTL=106 ID=6042 PROTO=UDP SPT=19 DPT=1417 LEN=6641 
Aug 29 23:20:00 SRC=124.133.3.233 LEN=6107 TOS=0x00 PREC=0x00 TTL=235 ID=17547 PROTO=UDP SPT=19 DPT=1417 LEN=6087 
Aug 29 23:20:00 SRC=123.30.186.226 LEN=5962 TOS=0x00 PREC=0x00 TTL=115 ID=28871 PROTO=UDP SPT=19 DPT=1417 LEN=5942 
Aug 29 23:20:00 SRC=66.45.242.74 LEN=2676 TOS=0x00 PREC=0x00 TTL=119 ID=6368 PROTO=UDP SPT=19 DPT=1417 LEN=2656 
Aug 29 23:20:00 SRC=217.196.72.150 LEN=3137 TOS=0x00 PREC=0x00 TTL=120 ID=6003 PROTO=UDP SPT=19 DPT=1417 LEN=3117 
Aug 29 23:20:00 SRC=217.168.150.211 LEN=3480 TOS=0x00 PREC=0x00 TTL=115 ID=1430 PROTO=UDP SPT=19 DPT=1417 LEN=3460 
Aug 29 23:20:00 SRC=217.113.205.114 LEN=3869 TOS=0x00 PREC=0x00 TTL=115 ID=48685 PROTO=UDP SPT=19 DPT=1417 LEN=3849 
Aug 29 23:20:00 SRC=76.74.229.78 LEN=6142 TOS=0x00 PREC=0x00 TTL=114 ID=8209 PROTO=UDP SPT=19 DPT=1417 LEN=6122 
Aug 29 23:20:00 SRC=74.218.109.202 LEN=2217 TOS=0x00 PREC=0x40 TTL=108 ID=16299 PROTO=UDP SPT=19 DPT=1417 LEN=2197 
Aug 29 23:20:00 SRC=222.231.28.220 LEN=6230 TOS=0x00 PREC=0x00 TTL=108 ID=378 PROTO=UDP SPT=19 DPT=1417 LEN=6210 
Aug 29 23:20:00 SRC=69.129.67.235 LEN=6509 TOS=0x00 PREC=0x00 TTL=117 ID=27620 PROTO=UDP SPT=19 DPT=1417 LEN=6489 
Aug 29 23:20:00 SRC=119.235.50.251 LEN=4059 TOS=0x00 PREC=0x00 TTL=109 ID=9249 PROTO=UDP SPT=19 DPT=1417 LEN=4039 
Aug 29 23:20:00 SRC=65.205.122.194 LEN=3530 TOS=0x00 PREC=0x00 TTL=108 ID=6068 PROTO=UDP SPT=19 DPT=1417 LEN=3510 
Aug 29 23:20:00 SRC=217.170.118.235 LEN=6480 TOS=0x00 PREC=0x00 TTL=120 ID=27635 PROTO=UDP SPT=19 DPT=1417 LEN=6460 
Aug 29 23:20:00 SRC=67.21.4.50 LEN=2155 TOS=0x00 PREC=0x00 TTL=113 ID=39473 PROTO=UDP SPT=19 DPT=1417 LEN=2135 
Aug 29 23:20:00 SRC=217.116.194.18 LEN=3588 TOS=0x00 PREC=0x00 TTL=118 ID=14901 PROTO=UDP SPT=19 DPT=1417 LEN=3568 
Aug 29 23:20:00 SRC=222.188.81.164 LEN=6157 TOS=0x00 PREC=0x00 TTL=105 ID=4549 PROTO=UDP SPT=19 DPT=1417 LEN=6137 
Aug 29 23:20:00 SRC=62.146.77.168 LEN=2203 TOS=0x00 PREC=0x00 TTL=122 ID=14380 PROTO=UDP SPT=19 DPT=1417 LEN=2183 
Aug 29 23:20:00 SRC=217.170.113.3 LEN=3883 TOS=0x00 PREC=0x00 TTL=38 ID=51336 PROTO=UDP SPT=19 DPT=1417 LEN=3863 
Aug 29 23:20:00 SRC=221.186.90.221 LEN=3640 TOS=0x00 PREC=0x00 TTL=106 ID=20583 PROTO=UDP SPT=19 DPT=1417 LEN=3620 
Aug 29 23:20:00 SRC=65.42.175.74 LEN=4981 TOS=0x00 PREC=0x00 TTL=111 ID=33542 PROTO=UDP SPT=19 DPT=1417 LEN=4961 
Aug 29 23:20:00 SRC=62.244.208.50 LEN=5817 TOS=0x00 PREC=0x00 TTL=114 ID=15951 PROTO=UDP SPT=19 DPT=1417 LEN=5797 
Aug 29 23:20:00 SRC=124.133.254.15 LEN=4532 TOS=0x00 PREC=0x00 TTL=43 ID=9537 PROTO=UDP SPT=19 DPT=1417 LEN=4512 
Aug 29 23:20:00 SRC=67.104.61.116 LEN=6899 TOS=0x00 PREC=0x00 TTL=112 ID=16276 PROTO=UDP SPT=19 DPT=1417 LEN=6879 
Aug 29 23:20:00 SRC=62.73.5.100 LEN=2556 TOS=0x00 PREC=0x00 TTL=115 ID=5100 PROTO=UDP SPT=19 DPT=1417 LEN=2536 
Aug 29 23:20:00 SRC=221.133.241.83 LEN=6829 TOS=0x08 PREC=0x20 TTL=100 ID=27039 PROTO=UDP SPT=19 DPT=1417 LEN=6809 
Aug 29 23:20:00 SRC=164.8.32.111 LEN=2246 TOS=0x00 PREC=0x00 TTL=115 ID=30654 PROTO=UDP SPT=19 DPT=1417 LEN=2226 
Aug 29 23:20:00 SRC=63.246.141.91 LEN=2310 TOS=0x00 PREC=0x00 TTL=119 ID=30567 PROTO=UDP SPT=19 DPT=1417 LEN=2290 
Aug 29 23:20:00 SRC=64.139.146.178 LEN=5383 TOS=0x00 PREC=0x00 TTL=115 ID=18201 PROTO=UDP SPT=19 DPT=1417 LEN=5363 
Aug 29 23:20:00 SRC=221.234.38.195 LEN=1504 TOS=0x00 PREC=0x00 TTL=106 ID=5367 PROTO=UDP SPT=19 DPT=1417 LEN=1484 
Aug 29 23:20:00 SRC=65.110.42.40 LEN=3088 TOS=0x00 PREC=0x00 TTL=119 ID=2766 PROTO=UDP SPT=19 DPT=1417 LEN=3068 
Aug 29 23:20:00 SRC=216.185.43.223 LEN=6391 TOS=0x00 PREC=0x00 TTL=112 ID=2641 PROTO=UDP SPT=19 DPT=1417 LEN=6371 
Aug 29 23:20:00 SRC=64.151.69.52 LEN=2993 TOS=0x00 PREC=0x00 TTL=111 ID=30516 PROTO=UDP SPT=19 DPT=1417 LEN=2973 
Aug 29 23:20:00 SRC=204.51.179.148 LEN=4976 TOS=0x00 PREC=0x00 TTL=111 ID=11633 PROTO=UDP SPT=19 DPT=1417 LEN=4956 
Aug 29 23:20:00 SRC=173.1.128.35 LEN=5779 TOS=0x00 PREC=0x00 TTL=111 ID=25585 PROTO=UDP SPT=19 DPT=1417 LEN=5759 
Aug 29 23:20:00 SRC=64.151.112.172 LEN=1599 TOS=0x00 PREC=0x00 TTL=111 ID=26231 PROTO=UDP SPT=19 DPT=1417 LEN=1579 
Aug 29 23:20:00 SRC=69.25.95.178 LEN=4285 TOS=0x00 PREC=0x00 TTL=111 ID=30945 PROTO=UDP SPT=19 DPT=1417 LEN=4265 
Aug 29 23:20:00 SRC=216.249.103.195 LEN=6984 TOS=0x00 PREC=0x00 TTL=118 ID=4225 PROTO=UDP SPT=19 DPT=1417 LEN=6964 
Aug 29 23:20:00 SRC=115.124.122.182 LEN=1840 TOS=0x00 PREC=0x00 TTL=120 ID=18797 PROTO=UDP SPT=19 DPT=1417 LEN=1820 
Aug 29 23:20:00 SRC=69.59.184.244 LEN=3051 TOS=0x00 PREC=0x00 TTL=111 ID=22735 PROTO=UDP SPT=19 DPT=1417 LEN=3031 
Aug 29 23:20:00 SRC=213.175.194.68 LEN=6131 TOS=0x00 PREC=0x00 TTL=118 ID=17257 PROTO=UDP SPT=19 DPT=1417 LEN=6111 
Aug 29 23:20:00 SRC=213.229.90.70 LEN=4941 TOS=0x00 PREC=0x00 TTL=119 ID=12721 PROTO=UDP SPT=19 DPT=1417 LEN=4921 
Aug 29 23:20:00 SRC=220.248.27.2 LEN=6124 TOS=0x00 PREC=0x00 TTL=43 ID=33713 PROTO=UDP SPT=19 DPT=1417 LEN=6104 
Aug 29 23:20:00 SRC=64.69.45.16 LEN=3056 TOS=0x00 PREC=0x00 TTL=119 ID=22844 PROTO=UDP SPT=19 DPT=1417 LEN=3036 
Aug 29 23:20:00 SRC=64.38.225.40 LEN=5815 TOS=0x00 PREC=0x00 TTL=117 ID=18057 PROTO=UDP SPT=19 DPT=1417 LEN=5795 
Aug 29 23:20:00 SRC=219.142.102.106 LEN=2040 TOS=0x00 PREC=0x00 TTL=106 ID=28931 PROTO=UDP SPT=19 DPT=1417 LEN=2020 
Aug 29 23:20:00 SRC=64.69.45.10 LEN=1985 TOS=0x00 PREC=0x00 TTL=119 ID=220 PROTO=UDP SPT=19 DPT=1417 LEN=1965 
Aug 29 23:20:00 SRC=216.17.40.67 LEN=2773 TOS=0x00 PREC=0x00 TTL=118 ID=11259 PROTO=UDP SPT=19 DPT=1417 LEN=2753 
Aug 29 23:20:00 SRC=118.163.62.249 LEN=3053 TOS=0x00 PREC=0x00 TTL=113 ID=6213 PROTO=UDP SPT=19 DPT=1417 LEN=3033 
Aug 29 23:20:00 SRC=212.204.212.131 LEN=3064 TOS=0x00 PREC=0x00 TTL=120 ID=36973 PROTO=UDP SPT=19 DPT=1417 LEN=3044 
Aug 29 23:20:00 SRC=63.133.131.2 LEN=1733 TOS=0x00 PREC=0x00 TTL=106 ID=3467 PROTO=UDP SPT=19 DPT=1417 LEN=1713 
Aug 29 23:20:00 SRC=67.210.114.226 LEN=2595 TOS=0x00 PREC=0x00 TTL=113 ID=19810 PROTO=UDP SPT=19 DPT=1417 LEN=2575 
Aug 29 23:20:00 SRC=75.151.221.23 LEN=4215 TOS=0x00 PREC=0x00 TTL=111 ID=17762 PROTO=UDP SPT=19 DPT=1417 LEN=4195 
Aug 29 23:20:00 SRC=64.151.82.196 LEN=5870 TOS=0x00 PREC=0x00 TTL=111 ID=9613 PROTO=UDP SPT=19 DPT=1417 LEN=5850 
Aug 29 23:20:00 SRC=216.171.167.210 LEN=3941 TOS=0x00 PREC=0x00 TTL=114 ID=8090 PROTO=UDP SPT=19 DPT=1417 LEN=3921 
Aug 29 23:20:00 SRC=69.59.143.100 LEN=3217 TOS=0x00 PREC=0x00 TTL=47 ID=11032 PROTO=UDP SPT=19 DPT=1417 LEN=3197 
Aug 29 23:20:00 SRC=69.59.172.44 LEN=2319 TOS=0x00 PREC=0x00 TTL=111 ID=27584 PROTO=UDP SPT=19 DPT=1417 LEN=2299 
Aug 29 23:20:00 SRC=69.59.174.44 LEN=3366 TOS=0x00 PREC=0x00 TTL=111 ID=8367 PROTO=UDP SPT=19 DPT=1417 LEN=3346 
Aug 29 23:20:00 SRC=69.59.184.228 LEN=6495 TOS=0x00 PREC=0x00 TTL=111 ID=1998 PROTO=UDP SPT=19 DPT=1417 LEN=6475 
Aug 29 23:20:00 SRC=64.151.76.148 LEN=2305 TOS=0x00 PREC=0x00 TTL=111 ID=11823 PROTO=UDP SPT=19 DPT=1417 LEN=2285 
Aug 29 23:20:00 SRC=69.59.183.228 LEN=3221 TOS=0x00 PREC=0x00 TTL=111 ID=1826 PROTO=UDP SPT=19 DPT=1417 LEN=3201 
Aug 29 23:20:00 SRC=64.151.107.12 LEN=5034 TOS=0x00 PREC=0x00 TTL=111 ID=21160 PROTO=UDP SPT=19 DPT=1417 LEN=5014 
Aug 29 23:20:00 SRC=64.151.95.100 LEN=4212 TOS=0x00 PREC=0x00 TTL=111 ID=23964 PROTO=UDP SPT=19 DPT=1417 LEN=4192 
Aug 29 23:20:00 SRC=64.151.92.212 LEN=6842 TOS=0x00 PREC=0x00 TTL=111 ID=6103 PROTO=UDP SPT=19 DPT=1417 LEN=6822 
Aug 29 23:20:00 SRC=12.34.168.9 LEN=4348 TOS=0x00 PREC=0x00 TTL=111 ID=34510 PROTO=UDP SPT=19 DPT=1417 LEN=4328 
Aug 29 23:20:00 SRC=64.151.81.218 LEN=5685 TOS=0x00 PREC=0x00 TTL=111 ID=24040 PROTO=UDP SPT=19 DPT=1417 LEN=5665 
Aug 29 23:20:00 SRC=69.59.151.84 LEN=6923 TOS=0x00 PREC=0x00 TTL=111 ID=31088 PROTO=UDP SPT=19 DPT=1417 LEN=6903 
Aug 29 23:20:00 SRC=64.151.95.172 LEN=6303 TOS=0x00 PREC=0x00 TTL=111 ID=6041 PROTO=UDP SPT=19 DPT=1417 LEN=6283 
Aug 29 23:20:00 SRC=216.55.139.86 LEN=2893 TOS=0x00 PREC=0x00 TTL=117 ID=9635 PROTO=UDP SPT=19 DPT=1417 LEN=2873 
Aug 29 23:20:00 SRC=64.151.88.140 LEN=6658 TOS=0x00 PREC=0x00 TTL=111 ID=19417 PROTO=UDP SPT=19 DPT=1417 LEN=6638 
Aug 29 23:20:00 SRC=212.95.41.225 LEN=6776 TOS=0x00 PREC=0x00 TTL=117 ID=13295 PROTO=UDP SPT=19 DPT=1417 LEN=6756 
Aug 29 23:20:00 SRC=212.68.36.210 LEN=6683 TOS=0x00 PREC=0x00 TTL=118 ID=28524 PROTO=UDP SPT=19 DPT=1417 LEN=6663 
Aug 29 23:20:00 SRC=212.68.39.181 LEN=6666 TOS=0x00 PREC=0x00 TTL=118 ID=10590 PROTO=UDP SPT=19 DPT=1417 LEN=6646 
Aug 29 23:20:00 SRC=212.248.1.82 LEN=5946 TOS=0x00 PREC=0x00 TTL=114 ID=60122 PROTO=UDP SPT=19 DPT=1417 LEN=5926 
Aug 29 23:20:00 SRC=213.184.199.36 LEN=3903 TOS=0x00 PREC=0x00 TTL=110 ID=14286 PROTO=UDP SPT=19 DPT=1417 LEN=3883 
Aug 29 23:20:00 SRC=212.91.32.26 LEN=2204 TOS=0x00 PREC=0x00 TTL=116 ID=15121 PROTO=UDP SPT=19 DPT=1417 LEN=2184 
Aug 29 23:20:00 SRC=62.48.35.14 LEN=6747 TOS=0x00 PREC=0x00 TTL=119 ID=24987 PROTO=UDP SPT=19 DPT=1417 LEN=6727 
Aug 29 23:20:00 SRC=219.148.147.233 LEN=3866 TOS=0x00 PREC=0x00 TTL=106 ID=18392 PROTO=UDP SPT=19 DPT=1417 LEN=3846 
Aug 29 23:20:00 SRC=218.98.32.175 LEN=4255 TOS=0x00 PREC=0x00 TTL=104 ID=3949 PROTO=UDP SPT=19 DPT=1417 LEN=4235 
Aug 29 23:20:00 SRC=218.202.227.210 LEN=6193 TOS=0x00 PREC=0x20 TTL=49 ID=14515 PROTO=UDP SPT=19 DPT=1417 LEN=6173 
Aug 29 23:20:00 SRC=115.30.4.4 LEN=6117 TOS=0x00 PREC=0x00 TTL=111 ID=12166 PROTO=UDP SPT=19 DPT=1417 LEN=6097 
Aug 29 23:20:00 SRC=220.232.182.148 LEN=3160 TOS=0x00 PREC=0x00 TTL=110 ID=15668 PROTO=UDP SPT=19 DPT=1417 LEN=3140 
Aug 29 23:20:00 SRC=117.239.6.24 LEN=2537 TOS=0x00 PREC=0x20 TTL=116 ID=7952 PROTO=UDP SPT=19 DPT=1417 LEN=2517 
Aug 29 23:20:00 SRC=5.77.36.158 LEN=5011 TOS=0x00 PREC=0x00 TTL=120 ID=16426 PROTO=UDP SPT=19 DPT=1417 LEN=4991 
Aug 29 23:20:00 SRC=218.106.254.23 LEN=5656 TOS=0x00 PREC=0x00 TTL=40 ID=9836 PROTO=UDP SPT=19 DPT=1417 LEN=5636 
Aug 29 23:20:00 SRC=218.4.46.230 LEN=3431 TOS=0x00 PREC=0x00 TTL=104 ID=6844 PROTO=UDP SPT=19 DPT=1417 LEN=3411 
Aug 29 23:20:00 SRC=110.34.36.90 LEN=2186 TOS=0x00 PREC=0x00 TTL=116 ID=149 PROTO=UDP SPT=19 DPT=1417 LEN=2166 
Aug 29 23:20:00 SRC=108.179.28.28 LEN=4035 TOS=0x00 PREC=0x00 TTL=115 ID=22738 PROTO=UDP SPT=19 DPT=1417 LEN=4015 
Aug 29 23:20:00 SRC=209.160.22.120 LEN=3432 TOS=0x00 PREC=0x00 TTL=120 ID=24023 PROTO=UDP SPT=19 DPT=1417 LEN=3412 
Aug 29 23:20:00 SRC=209.200.7.100 LEN=4975 TOS=0x00 PREC=0x00 TTL=120 ID=20520 PROTO=UDP SPT=19 DPT=1417 LEN=4955 
Aug 29 23:20:00 SRC=209.29.131.203 LEN=2899 TOS=0x00 PREC=0x00 TTL=117 ID=14560 PROTO=UDP SPT=19 DPT=1417 LEN=2879 
Aug 29 23:20:00 SRC=173.193.101.60 LEN=5173 TOS=0x00 PREC=0x00 TTL=29 ID=17747 PROTO=UDP SPT=19 DPT=1417 LEN=5153 
Aug 29 23:20:00 SRC=216.29.96.110 LEN=4840 TOS=0x00 PREC=0x00 TTL=110 ID=30594 PROTO=UDP SPT=19 DPT=1417 LEN=4820 
Aug 29 23:20:00 SRC=205.234.111.130 LEN=4433 TOS=0x00 PREC=0x00 TTL=55 ID=5912 PROTO=UDP SPT=19 DPT=1417 LEN=4413 
Aug 29 23:20:00 SRC=208.249.244.1 LEN=3644 TOS=0x00 PREC=0x00 TTL=117 ID=3986 PROTO=UDP SPT=19 DPT=1417 LEN=3624 
Aug 29 23:20:00 SRC=208.64.71.148 LEN=5806 TOS=0x00 PREC=0x00 TTL=117 ID=20753 PROTO=UDP SPT=19 DPT=1417 LEN=5786 
Aug 29 23:20:00 SRC=206.51.230.217 LEN=5378 TOS=0x00 PREC=0x00 TTL=111 ID=25114 PROTO=UDP SPT=19 DPT=1417 LEN=5358 
Aug 29 23:20:00 SRC=208.44.126.220 LEN=6238 TOS=0x00 PREC=0x00 TTL=113 ID=18470 PROTO=UDP SPT=19 DPT=1417 LEN=6218 
Aug 29 23:20:00 SRC=69.59.188.68 LEN=5074 TOS=0x00 PREC=0x00 TTL=111 ID=103 PROTO=UDP SPT=19 DPT=1417 LEN=5054 
Aug 29 23:20:00 SRC=64.151.85.20 LEN=3527 TOS=0x00 PREC=0x00 TTL=111 ID=19807 PROTO=UDP SPT=19 DPT=1417 LEN=3507 
Aug 29 23:20:00 SRC=69.59.134.108 LEN=1505 TOS=0x00 PREC=0x00 TTL=111 ID=3841 PROTO=UDP SPT=19 DPT=1417 LEN=1485 
Aug 29 23:20:00 SRC=208.123.215.20 LEN=3256 TOS=0x00 PREC=0x00 TTL=117 ID=13059 PROTO=UDP SPT=19 DPT=1417 LEN=3236 
Aug 29 23:20:00 SRC=208.109.209.104 LEN=6786 TOS=0x00 PREC=0x00 TTL=118 ID=706 PROTO=UDP SPT=19 DPT=1417 LEN=6766 
Aug 29 23:20:00 SRC=173.11.128.17 LEN=5758 TOS=0x00 PREC=0x00 TTL=110 ID=23934 PROTO=UDP SPT=19 DPT=1417 LEN=5738 
Aug 29 23:20:00 SRC=60.191.254.71 LEN=3679 TOS=0x00 PREC=0x00 TTL=106 ID=4141 PROTO=UDP SPT=19 DPT=1417 LEN=3659 
Aug 29 23:20:00 SRC=119.147.214.16 LEN=6041 TOS=0x00 PREC=0x00 TTL=40 ID=10367 PROTO=UDP SPT=19 DPT=1417 LEN=6021 
Aug 29 23:20:00 SRC=70.90.191.66 LEN=4747 TOS=0x00 PREC=0x00 TTL=110 ID=31476 PROTO=UDP SPT=19 DPT=1417 LEN=4727 
Aug 29 23:20:00 SRC=211.239.172.17 LEN=3210 TOS=0x00 PREC=0x00 TTL=118 ID=39709 PROTO=UDP SPT=19 DPT=1417 LEN=3190 
Aug 29 23:20:00 SRC=205.209.189.10 LEN=6882 TOS=0x00 PREC=0x00 TTL=111 ID=42321 PROTO=UDP SPT=19 DPT=1417 LEN=6862 
Aug 29 23:20:00 SRC=205.209.142.212 LEN=4619 TOS=0x00 PREC=0x00 TTL=111 ID=22796 PROTO=UDP SPT=19 DPT=1417 LEN=4599 
Aug 29 23:20:00 SRC=211.234.105.162 LEN=4410 TOS=0x00 PREC=0x00 TTL=107 ID=28272 PROTO=UDP SPT=19 DPT=1417 LEN=4390 
Aug 29 23:20:00 SRC=60.31.214.230 LEN=5985 TOS=0x00 PREC=0x00 TTL=107 ID=15100 PROTO=UDP SPT=19 DPT=1417 LEN=5965 
Aug 29 23:20:00 SRC=61.167.199.242 LEN=2282 TOS=0x00 PREC=0x00 TTL=104 ID=29072 PROTO=UDP SPT=19 DPT=1417 LEN=2262 
Aug 29 23:20:00 SRC=112.12.3.42 LEN=1683 TOS=0x00 PREC=0x00 TTL=112 ID=7160 PROTO=UDP SPT=19 DPT=1417 LEN=1663 
Aug 29 23:20:00 SRC=75.126.124.74 LEN=4582 TOS=0x00 PREC=0x00 TTL=117 ID=16872 PROTO=UDP SPT=19 DPT=1417 LEN=4562 
Aug 29 23:20:00 SRC=110.4.44.18 LEN=1888 TOS=0x00 PREC=0x00 TTL=114 ID=1568 PROTO=UDP SPT=19 DPT=1417 LEN=1868 
Aug 29 23:20:00 SRC=60.28.15.146 LEN=2581 TOS=0x00 PREC=0x00 TTL=105 ID=17336 PROTO=UDP SPT=19 DPT=1417 LEN=2561 
Aug 29 23:20:00 SRC=211.156.250.58 LEN=6148 TOS=0x00 PREC=0x00 TTL=42 ID=22178 PROTO=UDP SPT=19 DPT=1417 LEN=6128 
Aug 29 23:20:00 SRC=59.41.47.242 LEN=3594 TOS=0x00 PREC=0x00 TTL=43 ID=40025 PROTO=UDP SPT=19 DPT=1417 LEN=3574 
Aug 29 23:20:00 SRC=110.93.131.3 LEN=2766 TOS=0x00 PREC=0x00 TTL=116 ID=24927 PROTO=UDP SPT=19 DPT=1417 LEN=2746 
Aug 29 23:20:00 SRC=158.108.54.7 LEN=4099 TOS=0x00 PREC=0x00 TTL=115 ID=12605 PROTO=UDP SPT=19 DPT=1417 LEN=4079 
Aug 29 23:20:00 SRC=210.245.87.244 LEN=3513 TOS=0x00 PREC=0x00 TTL=116 ID=24907 PROTO=UDP SPT=19 DPT=1417 LEN=3493 
Aug 29 23:20:00 SRC=211.68.112.202 LEN=3880 TOS=0x00 PREC=0x00 TTL=33 ID=16945 PROTO=UDP SPT=19 DPT=1417 LEN=3860 
Aug 29 23:20:00 SRC=202.170.152.190 LEN=3227 TOS=0x08 PREC=0x40 TTL=104 ID=21034 PROTO=UDP SPT=19 DPT=1417 LEN=3207 
Aug 29 23:20:00 SRC=58.18.251.54 LEN=1689 TOS=0x00 PREC=0x00 TTL=104 ID=19747 PROTO=UDP SPT=19 DPT=1417 LEN=1669 
Aug 29 23:20:00 SRC=210.14.132.182 LEN=6530 TOS=0x00 PREC=0x00 TTL=106 ID=12736 PROTO=UDP SPT=19 DPT=1417 LEN=6510 
Aug 29 23:20:00 SRC=74.118.28.18 LEN=2120 TOS=0x00 PREC=0x00 TTL=115 ID=50840 PROTO=UDP SPT=19 DPT=1417 LEN=2100 
Aug 29 23:20:00 SRC=220.112.36.218 LEN=4273 TOS=0x00 PREC=0x00 TTL=104 ID=12095 PROTO=UDP SPT=19 DPT=1417 LEN=4253 
Aug 29 23:20:00 SRC=72.18.135.156 LEN=1764 TOS=0x00 PREC=0x00 TTL=118 ID=28205 PROTO=UDP SPT=19 DPT=1417 LEN=1744 
Aug 29 23:20:00 SRC=174.139.10.58 LEN=1893 TOS=0x00 PREC=0x00 TTL=117 ID=13611 PROTO=UDP SPT=19 DPT=1417 LEN=1873 
Aug 29 23:20:00 SRC=168.70.242.140 LEN=2084 TOS=0x00 PREC=0x00 TTL=111 ID=13488 PROTO=UDP SPT=19 DPT=1417 LEN=2064 
Aug 29 23:20:00 SRC=173.13.151.49 LEN=3983 TOS=0x00 PREC=0x00 TTL=108 ID=27477 PROTO=UDP SPT=19 DPT=1417 LEN=3963 
Aug 29 23:20:01 SRC=70.89.228.185 LEN=4117 TOS=0x00 PREC=0x00 TTL=114 ID=13018 PROTO=UDP SPT=19 DPT=1417 LEN=4097 
Aug 29 23:20:01 SRC=216.93.179.12 LEN=2076 TOS=0x00 PREC=0x00 TTL=111 ID=5674 PROTO=UDP SPT=19 DPT=1417 LEN=2056 
Aug 29 23:20:01 SRC=76.79.173.106 LEN=2127 TOS=0x00 PREC=0x40 TTL=109 ID=26966 PROTO=UDP SPT=19 DPT=1417 LEN=2107 
Aug 29 23:20:01 SRC=66.128.59.72 LEN=2115 TOS=0x00 PREC=0x00 TTL=118 ID=48 PROTO=UDP SPT=19 DPT=1417 LEN=2095 
Aug 29 23:20:01 SRC=65.99.214.162 LEN=1555 TOS=0x00 PREC=0x00 TTL=114 ID=22016 PROTO=UDP SPT=19 DPT=1417 LEN=1535 
Aug 29 23:20:01 SRC=217.16.235.82 LEN=1653 TOS=0x00 PREC=0x00 TTL=118 ID=27641 PROTO=UDP SPT=19 DPT=1417 LEN=1633 
Aug 29 23:20:01 SRC=208.125.48.165 LEN=6946 TOS=0x00 PREC=0x00 TTL=110 ID=7440 PROTO=UDP SPT=19 DPT=1417 LEN=6926 
Aug 29 23:20:01 SRC=62.80.173.50 LEN=2007 TOS=0x00 PREC=0x00 TTL=122 ID=4208 PROTO=UDP SPT=19 DPT=1417 LEN=1987 
Aug 29 23:20:01 SRC=216.155.149.196 LEN=1765 TOS=0x00 PREC=0x00 TTL=119 ID=11505 PROTO=UDP SPT=19 DPT=1417 LEN=1745 
Aug 29 23:20:01 SRC=12.231.193.106 LEN=1697 TOS=0x00 PREC=0x00 TTL=110 ID=24921 PROTO=UDP SPT=19 DPT=1417 LEN=1677 
Aug 29 23:20:01 SRC=64.58.34.2 LEN=1540 TOS=0x00 PREC=0x00 TTL=113 ID=869 PROTO=UDP SPT=19 DPT=1417 LEN=1520 
Aug 29 23:20:01 SRC=216.237.126.46 LEN=2153 TOS=0x00 PREC=0x00 TTL=114 ID=10310 PROTO=UDP SPT=19 DPT=1417 LEN=2133 
Aug 29 23:20:01 SRC=64.151.68.164 LEN=2121 TOS=0x00 PREC=0x00 TTL=111 ID=25048 PROTO=UDP SPT=19 DPT=1417 LEN=2101 
Aug 29 23:20:01 SRC=212.175.22.194 LEN=5395 TOS=0x00 PREC=0x00 TTL=113 ID=32557 PROTO=UDP SPT=19 DPT=1417 LEN=5375 
Aug 29 23:20:01 SRC=219.141.190.163 LEN=5228 TOS=0x00 PREC=0x00 TTL=106 ID=26967 PROTO=UDP SPT=19 DPT=1417 LEN=5208 
Aug 29 23:20:01 SRC=78.111.97.74 LEN=5025 TOS=0x00 PREC=0x00 TTL=121 ID=16732 PROTO=UDP SPT=19 DPT=1417 LEN=5005 
Aug 29 23:20:01 SRC=209.235.240.32 LEN=1576 TOS=0x00 PREC=0x00 TTL=119 ID=8277 PROTO=UDP SPT=19 DPT=1417 LEN=1556 
Aug 29 23:20:01 SRC=108.5.138.2 LEN=1557 TOS=0x00 PREC=0x00 TTL=113 ID=12088 PROTO=UDP SPT=19 DPT=1417 LEN=1537 
Aug 29 23:20:01 SRC=209.144.224.154 LEN=1644 TOS=0x00 PREC=0x00 TTL=110 ID=2807 PROTO=UDP SPT=19 DPT=1417 LEN=1624 
Aug 29 23:20:01 SRC=209.173.192.3 LEN=1776 TOS=0x00 PREC=0x00 TTL=115 ID=19203 PROTO=UDP SPT=19 DPT=1417 LEN=1756 
Aug 29 23:20:01 SRC=173.12.159.194 LEN=2063 TOS=0x00 PREC=0x00 TTL=111 ID=49762 PROTO=UDP SPT=19 DPT=1417 LEN=2043 
Aug 29 23:20:01 SRC=78.107.4.50 LEN=6119 TOS=0x08 PREC=0x80 TTL=119 ID=4597 PROTO=UDP SPT=19 DPT=1417 LEN=6099 
Aug 29 23:20:01 SRC=61.132.45.197 LEN=1903 TOS=0x00 PREC=0x00 TTL=104 ID=40451 PROTO=UDP SPT=19 DPT=1417 LEN=1883 
Aug 29 23:20:01 SRC=60.191.49.203 LEN=1508 TOS=0x00 PREC=0x00 TTL=105 ID=9195 PROTO=UDP SPT=19 DPT=1417 LEN=1488 
Aug 29 23:20:01 SRC=216.173.193.129 LEN=1743 TOS=0x00 PREC=0x00 TTL=113 ID=21935 PROTO=UDP SPT=19 DPT=1417 LEN=1723 
Aug 29 23:20:01 SRC=60.161.231.123 LEN=1888 TOS=0x00 PREC=0x00 TTL=107 ID=30642 PROTO=UDP SPT=19 DPT=1417 LEN=1868 
Aug 29 23:20:01 SRC=210.196.194.204 LEN=1808 TOS=0x00 PREC=0x00 TTL=110 ID=7223 PROTO=UDP SPT=19 DPT=1417 LEN=1788 
Aug 29 23:20:01 SRC=76.73.125.226 LEN=5489 TOS=0x00 PREC=0x00 TTL=119 ID=24356 PROTO=UDP SPT=19 DPT=1417 LEN=5469 
Aug 29 23:20:01 SRC=76.74.223.198 LEN=1675 TOS=0x00 PREC=0x00 TTL=119 ID=15718 PROTO=UDP SPT=19 DPT=1417 LEN=1655 
Aug 29 23:20:01 SRC=75.126.157.172 LEN=2106 TOS=0x00 PREC=0x00 TTL=117 ID=21012 PROTO=UDP SPT=19 DPT=1417 LEN=2086 
Aug 29 23:20:01 SRC=75.146.179.185 LEN=1621 TOS=0x00 PREC=0x00 TTL=113 ID=29087 PROTO=UDP SPT=19 DPT=1417 LEN=1601 
Aug 29 23:20:01 SRC=210.245.122.10 LEN=5206 TOS=0x00 PREC=0x00 TTL=111 ID=17733 PROTO=UDP SPT=19 DPT=1417 LEN=5186 
Aug 29 23:20:01 SRC=210.77.88.2 LEN=2139 TOS=0x00 PREC=0x00 TTL=41 ID=31915 PROTO=UDP SPT=19 DPT=1417 LEN=2119 
Aug 29 23:20:01 SRC=173.248.149.186 LEN=1525 TOS=0x00 PREC=0x00 TTL=117 ID=26529 PROTO=UDP SPT=19 DPT=1417 LEN=1505 
Aug 29 23:20:01 SRC=72.18.146.82 LEN=1712 TOS=0x00 PREC=0x00 TTL=117 ID=16234 PROTO=UDP SPT=19 DPT=1417 LEN=1692 
Aug 29 23:20:01 SRC=173.62.173.35 LEN=1878 TOS=0x00 PREC=0x00 TTL=114 ID=21940 PROTO=UDP SPT=19 DPT=1417 LEN=1858 
Aug 29 23:20:02 SRC=217.13.81.69 LEN=2421 TOS=0x00 PREC=0x00 TTL=114 ID=15048 PROTO=UDP SPT=19 DPT=1417 LEN=2401 
Aug 29 23:20:02 SRC=70.88.218.29 LEN=2114 TOS=0x00 PREC=0x00 TTL=115 ID=48218 PROTO=UDP SPT=19 DPT=1417 LEN=2094 
Aug 29 23:20:02 SRC=58.30.239.236 LEN=3102 TOS=0x00 PREC=0x00 TTL=100 ID=29898 PROTO=UDP SPT=19 DPT=1417 LEN=3082 
Aug 29 23:20:02 SRC=58.56.108.79 LEN=1999 TOS=0x00 PREC=0x00 TTL=104 ID=26872 PROTO=UDP SPT=19 DPT=1417 LEN=1979 
Aug 29 23:20:02 SRC=68.178.242.20 LEN=1800 TOS=0x00 PREC=0x00 TTL=117 ID=12925 PROTO=UDP SPT=19 DPT=1417 LEN=1780 
Aug 29 23:20:02 SRC=67.215.225.103 LEN=1575 TOS=0x00 PREC=0x00 TTL=117 ID=26960 PROTO=UDP SPT=19 DPT=1417 LEN=1555 
Aug 29 23:20:02 SRC=121.78.237.45 LEN=1595 TOS=0x00 PREC=0x00 TTL=108 ID=18384 PROTO=UDP SPT=19 DPT=1417 LEN=1575 
Aug 29 23:20:02 SRC=66.252.136.201 LEN=2046 TOS=0x00 PREC=0x00 TTL=114 ID=24967 PROTO=UDP SPT=19 DPT=1417 LEN=2026 
Aug 29 23:20:02 SRC=66.191.137.250 LEN=1627 TOS=0x00 PREC=0x00 TTL=114 ID=13057 PROTO=UDP SPT=19 DPT=1417 LEN=1607 
Aug 29 23:20:02 SRC=217.116.196.144 LEN=1542 TOS=0x00 PREC=0x00 TTL=118 ID=26379 PROTO=UDP SPT=19 DPT=1417 LEN=1522 
Aug 29 23:20:02 SRC=66.85.150.58 LEN=1854 TOS=0x00 PREC=0x00 TTL=116 ID=31766 PROTO=UDP SPT=19 DPT=1417 LEN=1834 
Aug 29 23:20:02 SRC=64.191.37.69 LEN=1911 TOS=0x00 PREC=0x00 TTL=119 ID=24758 PROTO=UDP SPT=19 DPT=1417 LEN=1891 
Aug 29 23:20:02 SRC=199.34.125.131 LEN=1680 TOS=0x00 PREC=0x00 TTL=119 ID=20890 PROTO=UDP SPT=19 DPT=1417 LEN=1660 
Aug 29 23:20:02 SRC=123.178.28.8 LEN=1766 TOS=0x00 PREC=0x00 TTL=105 ID=58082 PROTO=UDP SPT=19 DPT=1417 LEN=1746 
Aug 29 23:20:02 SRC=222.21.80.4 LEN=2004 TOS=0x00 PREC=0x00 TTL=101 ID=12330 PROTO=UDP SPT=19 DPT=1417 LEN=1984 
Aug 29 23:20:02 SRC=65.175.93.98 LEN=5264 TOS=0x00 PREC=0x00 TTL=113 ID=10093 PROTO=UDP SPT=19 DPT=1417 LEN=5244 
Aug 29 23:20:02 SRC=216.70.56.169 LEN=1588 TOS=0x00 PREC=0x00 TTL=117 ID=27564 PROTO=UDP SPT=19 DPT=1417 LEN=1568 
Aug 29 23:20:02 SRC=220.196.58.229 LEN=1881 TOS=0x00 PREC=0x00 TTL=107 ID=28675 PROTO=UDP SPT=19 DPT=1417 LEN=1861 
Aug 29 23:20:02 SRC=69.59.129.188 LEN=1511 TOS=0x00 PREC=0x00 TTL=111 ID=977 PROTO=UDP SPT=19 DPT=1417 LEN=1491 
Aug 29 23:20:02 SRC=212.43.238.20 LEN=2099 TOS=0x00 PREC=0x00 TTL=54 ID=15670 PROTO=UDP SPT=19 DPT=1417 LEN=2079 
Aug 29 23:20:02 SRC=212.91.32.6 LEN=2055 TOS=0x00 PREC=0x00 TTL=116 ID=17979 PROTO=UDP SPT=19 DPT=1417 LEN=2035 
Aug 29 23:20:02 SRC=212.175.19.210 LEN=1726 TOS=0x00 PREC=0x00 TTL=113 ID=26133 PROTO=UDP SPT=19 DPT=1417 LEN=1706 
Aug 29 23:20:02 SRC=212.34.152.174 LEN=1935 TOS=0x00 PREC=0x00 TTL=117 ID=2500 PROTO=UDP SPT=19 DPT=1417 LEN=1915 
Aug 29 23:20:02 SRC=66.182.145.24 LEN=1522 TOS=0x00 PREC=0x00 TTL=109 ID=49056 PROTO=UDP SPT=19 DPT=1417 LEN=1502 
Aug 29 23:20:02 SRC=67.202.84.82 LEN=2019 TOS=0x00 PREC=0x00 TTL=117 ID=27758 PROTO=UDP SPT=19 DPT=1417 LEN=1999 
Aug 29 23:20:02 SRC=216.240.154.235 LEN=2165 TOS=0x00 PREC=0x00 TTL=119 ID=3178 PROTO=UDP SPT=19 DPT=1417 LEN=2145 
Aug 29 23:20:02 SRC=64.183.52.219 LEN=1788 TOS=0x00 PREC=0x40 TTL=109 ID=6730 PROTO=UDP SPT=19 DPT=1417 LEN=1768 
Aug 29 23:20:02 SRC=70.89.253.177 LEN=5160 TOS=0x00 PREC=0x00 TTL=112 ID=1378 PROTO=UDP SPT=19 DPT=1417 LEN=5140 
Aug 29 23:20:02 SRC=206.191.160.102 LEN=1545 TOS=0x00 PREC=0x00 TTL=108 ID=15994 PROTO=UDP SPT=19 DPT=1417 LEN=1525 
Aug 29 23:20:02 SRC=58.211.15.33 LEN=2094 TOS=0x00 PREC=0x00 TTL=105 ID=16684 PROTO=UDP SPT=19 DPT=1417 LEN=2074 
Aug 29 23:20:02 SRC=103.28.15.86 LEN=1550 TOS=0x00 PREC=0x00 TTL=113 ID=16598 PROTO=UDP SPT=19 DPT=1417 LEN=1530 
Aug 29 23:20:02 SRC=121.52.215.218 LEN=2866 TOS=0x00 PREC=0x00 TTL=105 ID=23611 PROTO=UDP SPT=19 DPT=1417 LEN=2846 
Aug 29 23:20:02 SRC=61.133.213.131 LEN=1943 TOS=0x00 PREC=0x00 TTL=105 ID=11715 PROTO=UDP SPT=19 DPT=1417 LEN=1923 
Aug 29 23:20:02 SRC=173.193.10.20 LEN=2112 TOS=0x00 PREC=0x00 TTL=117 ID=1973 PROTO=UDP SPT=19 DPT=1417 LEN=2092 
Aug 29 23:20:02 SRC=174.37.168.162 LEN=1880 TOS=0x00 PREC=0x00 TTL=115 ID=6334 PROTO=UDP SPT=19 DPT=1417 LEN=1860 
Aug 29 23:20:02 SRC=71.194.95.45 LEN=4084 TOS=0x00 PREC=0x00 TTL=114 ID=27589 PROTO=UDP SPT=19 DPT=1417 LEN=4064 
Aug 29 23:20:03 SRC=69.15.27.75 LEN=2041 TOS=0x00 PREC=0x00 TTL=109 ID=1043 PROTO=UDP SPT=19 DPT=1417 LEN=2021 
Aug 29 23:20:03 SRC=66.240.252.150 LEN=2148 TOS=0x00 PREC=0x00 TTL=109 ID=7302 PROTO=UDP SPT=19 DPT=1417 LEN=2128 
Aug 29 23:20:03 SRC=75.76.96.253 LEN=2014 TOS=0x00 PREC=0x00 TTL=115 ID=49026 PROTO=UDP SPT=19 DPT=1417 LEN=1994 
Aug 29 23:20:03 SRC=62.27.9.192 LEN=2127 TOS=0x00 PREC=0x00 TTL=123 ID=13378 PROTO=UDP SPT=19 DPT=1417 LEN=2107 
Aug 29 23:20:03 SRC=216.206.238.106 LEN=2105 TOS=0x00 PREC=0x00 TTL=113 ID=30690 PROTO=UDP SPT=19 DPT=1417 LEN=2085 
Aug 29 23:20:03 SRC=117.53.153.204 LEN=2002 TOS=0x00 PREC=0x00 TTL=114 ID=14494 PROTO=UDP SPT=19 DPT=1417 LEN=1982 
Aug 29 23:20:03 SRC=66.7.201.16 LEN=6890 TOS=0x00 PREC=0x00 TTL=55 ID=7717 PROTO=UDP SPT=19 DPT=1417 LEN=6870 
Aug 29 23:20:03 SRC=61.131.40.66 LEN=1941 TOS=0x00 PREC=0x00 TTL=105 ID=13264 PROTO=UDP SPT=19 DPT=1417 LEN=1921 
Aug 29 23:20:03 SRC=59.144.5.98 LEN=1816 TOS=0x00 PREC=0x00 TTL=120 ID=572 PROTO=UDP SPT=19 DPT=1417 LEN=1796 
Aug 29 23:20:03 SRC=74.93.149.165 LEN=2099 TOS=0x00 PREC=0x00 TTL=111 ID=13875 PROTO=UDP SPT=19 DPT=1417 LEN=2079 
Aug 29 23:20:03 SRC=111.93.149.35 LEN=2531 TOS=0x00 PREC=0x00 TTL=109 ID=8523 PROTO=UDP SPT=19 DPT=1417 LEN=2511 
Aug 29 23:20:04 SRC=62.149.218.52 LEN=1585 TOS=0x08 PREC=0x20 TTL=118 ID=27977 PROTO=UDP SPT=19 DPT=1417 LEN=1565 
Aug 29 23:20:04 SRC=173.10.18.125 LEN=2168 TOS=0x00 PREC=0x00 TTL=112 ID=9288 PROTO=UDP SPT=19 DPT=1417 LEN=2148 
Aug 29 23:20:04 SRC=74.93.39.137 LEN=2145 TOS=0x00 PREC=0x00 TTL=110 ID=23290 PROTO=UDP SPT=19 DPT=1417 LEN=2125 
Aug 29 23:20:04 SRC=75.145.248.213 LEN=1841 TOS=0x00 PREC=0x00 TTL=114 ID=18632 PROTO=UDP SPT=19 DPT=1417 LEN=1821 
Aug 29 23:20:04 SRC=209.172.172.130 LEN=1453 TOS=0x00 PREC=0x00 TTL=111 ID=25947 PROTO=UDP SPT=19 DPT=1417 LEN=1433 
Aug 29 23:20:04 SRC=170.210.140.235 LEN=1776 TOS=0x00 PREC=0x00 TTL=103 ID=5553 PROTO=UDP SPT=19 DPT=1417 LEN=1756 
Aug 29 23:20:04 SRC=110.4.44.130 LEN=1578 TOS=0x00 PREC=0x00 TTL=114 ID=11342 PROTO=UDP SPT=19 DPT=1417 LEN=1558 
Aug 29 23:20:04 SRC=173.247.178.247 LEN=1811 TOS=0x00 PREC=0x00 TTL=108 ID=55968 PROTO=UDP SPT=19 DPT=1417 LEN=1791 
Aug 29 23:20:05 SRC=67.212.88.130 LEN=1617 TOS=0x00 PREC=0x00 TTL=118 ID=9240 PROTO=UDP SPT=19 DPT=1417 LEN=1597 
Aug 29 23:20:05 SRC=67.106.87.134 LEN=2063 TOS=0x00 PREC=0x00 TTL=112 ID=41768 PROTO=UDP SPT=19 DPT=1417 LEN=2043 
Aug 29 23:20:05 SRC=64.183.13.10 LEN=2599 TOS=0x00 PREC=0x40 TTL=109 ID=18051 PROTO=UDP SPT=19 DPT=1417 LEN=2579 
Aug 29 23:20:05 SRC=12.170.222.11 LEN=2427 TOS=0x00 PREC=0x00 TTL=111 ID=16968 PROTO=UDP SPT=19 DPT=1417 LEN=2407 
Aug 29 23:20:05 SRC=211.208.81.99 LEN=1569 TOS=0x00 PREC=0x00 TTL=116 ID=41733 PROTO=UDP SPT=19 DPT=1417 LEN=1549 
Aug 29 23:20:05 SRC=124.153.78.167 LEN=1525 TOS=0x00 PREC=0x20 TTL=111 ID=27659 PROTO=UDP SPT=19 DPT=1417 LEN=1505 
Aug 29 23:20:06 SRC=61.195.147.131 LEN=5003 TOS=0x00 PREC=0x00 TTL=106 ID=44119 PROTO=UDP SPT=19 DPT=1417 LEN=4983 
Aug 29 23:20:06 SRC=113.11.201.214 LEN=2106 TOS=0x00 PREC=0x00 TTL=38 ID=7569 PROTO=UDP SPT=19 DPT=1417 LEN=2086 
Aug 29 23:20:06 SRC=217.59.111.2 LEN=1624 TOS=0x00 PREC=0x00 TTL=115 ID=9055 PROTO=UDP SPT=19 DPT=1417 LEN=1604 
Aug 29 23:20:06 SRC=210.216.28.205 LEN=1938 TOS=0x00 PREC=0x00 TTL=105 ID=24368 PROTO=UDP SPT=19 DPT=1417 LEN=1918 
Aug 29 23:20:06 SRC=74.95.228.187 LEN=1928 TOS=0x00 PREC=0x00 TTL=108 ID=12746 PROTO=UDP SPT=19 DPT=1417 LEN=1908 
Aug 29 23:20:06 SRC=75.146.148.19 LEN=1707 TOS=0x00 PREC=0x00 TTL=113 ID=26449 PROTO=UDP SPT=19 DPT=1417 LEN=1687 
Aug 29 23:20:06 SRC=173.162.37.244 LEN=2160 TOS=0x00 PREC=0x00 TTL=113 ID=3317 PROTO=UDP SPT=19 DPT=1417 LEN=2140 
Aug 29 23:20:06 SRC=75.150.116.197 LEN=1669 TOS=0x00 PREC=0x00 TTL=112 ID=6312 PROTO=UDP SPT=19 DPT=1417 LEN=1649 
Aug 29 23:20:07 SRC=12.172.164.31 LEN=1850 TOS=0x00 PREC=0x00 TTL=110 ID=3997 PROTO=UDP SPT=19 DPT=1417 LEN=1830 
Aug 29 23:20:07 SRC=208.118.126.82 LEN=3812 TOS=0x00 PREC=0x00 TTL=115 ID=8944 PROTO=UDP SPT=19 DPT=1417 LEN=3792 
Aug 29 23:20:07 SRC=213.203.157.126 LEN=1932 TOS=0x00 PREC=0x00 TTL=117 ID=6950 PROTO=UDP SPT=19 DPT=1417 LEN=1912 
Aug 29 23:20:08 SRC=217.133.217.82 LEN=2344 TOS=0x00 PREC=0x00 TTL=117 ID=58270 PROTO=UDP SPT=19 DPT=1417 LEN=2324 
Aug 29 23:20:08 SRC=123.141.20.249 LEN=3726 TOS=0x00 PREC=0x00 TTL=102 ID=17026 PROTO=UDP SPT=19 DPT=1417 LEN=3706 
Aug 29 23:20:08 SRC=70.91.226.109 LEN=2130 TOS=0x00 PREC=0x00 TTL=113 ID=30944 PROTO=UDP SPT=19 DPT=1417 LEN=2110 
Aug 29 23:20:09 SRC=221.112.230.5 LEN=3803 TOS=0x00 PREC=0x00 TTL=102 ID=33252 PROTO=UDP SPT=19 DPT=1417 LEN=3783 
Aug 29 23:20:09 SRC=75.148.208.81 LEN=2527 TOS=0x00 PREC=0x00 TTL=109 ID=20730 PROTO=UDP SPT=19 DPT=1417 LEN=2507 
Aug 29 23:20:09 SRC=112.65.229.181 LEN=2458 TOS=0x00 PREC=0x00 TTL=104 ID=11902 PROTO=UDP SPT=19 DPT=1417 LEN=2438 
Aug 29 23:20:09 SRC=212.40.137.4 LEN=1542 TOS=0x00 PREC=0x00 TTL=113 ID=6571 PROTO=UDP SPT=19 DPT=1417 LEN=1522 
Aug 29 23:20:12 SRC=208.125.48.92 LEN=6262 TOS=0x00 PREC=0x00 TTL=110 ID=25346 PROTO=UDP SPT=19 DPT=1417 LEN=6242 
Aug 29 23:20:13 SRC=62.80.230.237 LEN=3430 TOS=0x00 PREC=0x00 TTL=119 ID=2593 PROTO=UDP SPT=19 DPT=1417 LEN=3410 
Aug 29 23:20:13 SRC=64.206.127.226 LEN=6875 TOS=0x00 PREC=0x00 TTL=110 ID=19811 PROTO=UDP SPT=19 DPT=1417 LEN=6855 
Aug 29 23:20:15 SRC=61.178.129.93 LEN=1599 TOS=0x00 PREC=0x00 TTL=105 ID=57672 PROTO=UDP SPT=19 DPT=1417 LEN=1579 
Aug 29 23:20:16 SRC=108.49.250.14 LEN=2005 TOS=0x00 PREC=0x00 TTL=113 ID=39124 PROTO=UDP SPT=19 DPT=1417 LEN=1985 
Aug 29 23:20:16 SRC=209.51.0.226 LEN=3435 TOS=0x00 PREC=0x00 TTL=105 ID=17227 PROTO=UDP SPT=19 DPT=1417 LEN=3415 
Aug 29 23:20:17 SRC=71.183.109.29 LEN=4801 TOS=0x00 PREC=0x00 TTL=112 ID=26215 PROTO=UDP SPT=19 DPT=1417 LEN=4781 
Aug 29 23:20:17 SRC=61.133.213.190 LEN=5456 TOS=0x00 PREC=0x00 TTL=105 ID=58030 PROTO=UDP SPT=19 DPT=1417 LEN=5436 
Aug 29 23:20:17 SRC=213.149.110.162 LEN=1557 TOS=0x00 PREC=0x00 TTL=116 ID=1211 PROTO=UDP SPT=19 DPT=1417 LEN=1537 
Aug 29 23:20:18 SRC=65.216.234.6 LEN=1540 TOS=0x00 PREC=0x00 TTL=113 ID=14679 PROTO=UDP SPT=19 DPT=1417 LEN=1520 
Aug 29 23:20:18 SRC=216.36.151.65 LEN=1713 TOS=0x00 PREC=0x00 TTL=112 ID=65166 PROTO=UDP SPT=19 DPT=1417 LEN=1693 
Aug 29 23:20:18 SRC=173.196.255.82 LEN=1751 TOS=0x00 PREC=0x40 TTL=109 ID=28174 PROTO=UDP SPT=19 DPT=1417 LEN=1731 
Aug 29 23:20:19 SRC=211.232.51.71 LEN=5698 TOS=0x00 PREC=0x00 TTL=107 ID=16348 PROTO=UDP SPT=19 DPT=1417 LEN=5678 
Aug 29 23:20:19 SRC=180.150.249.68 LEN=1970 TOS=0x00 PREC=0x20 TTL=109 ID=26660 PROTO=UDP SPT=19 DPT=1417 LEN=1950 
Aug 29 23:20:23 SRC=58.96.111.37 LEN=6416 TOS=0x00 PREC=0x00 TTL=100 ID=16635 PROTO=UDP SPT=19 DPT=1417 LEN=6396 
Aug 29 23:20:23 SRC=69.254.213.31 LEN=1816 TOS=0x00 PREC=0x00 TTL=110 ID=7692 PROTO=UDP SPT=19 DPT=1417 LEN=1796 
Aug 29 23:20:25 SRC=209.181.227.117 LEN=1724 TOS=0x00 PREC=0x00 TTL=113 ID=55063 PROTO=UDP SPT=19 DPT=1417 LEN=1704 
Aug 29 23:20:29 SRC=219.19.84.110 LEN=1672 TOS=0x00 PREC=0x00 TTL=112 ID=17782 PROTO=UDP SPT=19 DPT=1417 LEN=1652 
Aug 29 23:20:32 SRC=122.224.34.181 LEN=4502 TOS=0x00 PREC=0x00 TTL=105 ID=15871 PROTO=UDP SPT=19 DPT=1417 LEN=4482 
Aug 29 23:20:33 SRC=70.88.173.125 LEN=1970 TOS=0x00 PREC=0x00 TTL=110 ID=269 PROTO=UDP SPT=19 DPT=1417 LEN=1950 
Aug 29 23:20:34 SRC=113.161.96.214 LEN=1580 TOS=0x00 PREC=0x00 TTL=110 ID=7009 PROTO=UDP SPT=19 DPT=1417 LEN=1560 
Aug 29 23:20:34 SRC=64.151.89.76 LEN=6286 TOS=0x00 PREC=0x00 TTL=111 ID=13250 PROTO=UDP SPT=19 DPT=1417 LEN=6266 
Aug 29 23:20:35 SRC=113.108.97.187 LEN=4892 TOS=0x00 PREC=0x00 TTL=43 ID=382 PROTO=UDP SPT=19 DPT=1417 LEN=4872 
Aug 29 23:20:35 SRC=70.191.252.22 LEN=5283 TOS=0x00 PREC=0x00 TTL=114 ID=23627 PROTO=UDP SPT=19 DPT=1417 LEN=5263 
Aug 29 23:20:36 SRC=114.113.156.52 LEN=1801 TOS=0x00 PREC=0x00 TTL=40 ID=31766 PROTO=UDP SPT=19 DPT=1417 LEN=1781 
Aug 29 23:20:37 SRC=159.224.16.16 LEN=5541 TOS=0x00 PREC=0x00 TTL=120 ID=2178 PROTO=UDP SPT=19 DPT=1417 LEN=5521 
Aug 29 23:20:44 SRC=125.46.62.108 LEN=2742 TOS=0x00 PREC=0x00 TTL=107 ID=38512 PROTO=UDP SPT=19 DPT=1417 LEN=2722 
Aug 29 23:20:51 SRC=66.240.238.201 LEN=6717 TOS=0x00 PREC=0x00 TTL=109 ID=8688 PROTO=UDP SPT=19 DPT=1417 LEN=6697 
Aug 29 23:20:51 SRC=222.191.250.101 LEN=4742 TOS=0x00 PREC=0x00 TTL=103 ID=23447 PROTO=UDP SPT=19 DPT=1417 LEN=4722 
Aug 29 23:20:52 SRC=119.145.40.67 LEN=4014 TOS=0x00 PREC=0x00 TTL=104 ID=17905 PROTO=UDP SPT=19 DPT=1417 LEN=3994 
Aug 29 23:20:52 SRC=66.23.235.155 LEN=4935 TOS=0x00 PREC=0x00 TTL=119 ID=14016 PROTO=UDP SPT=19 DPT=1417 LEN=4915 
Aug 29 23:20:53 SRC=178.211.48.176 LEN=5855 TOS=0x00 PREC=0x00 TTL=120 ID=3719 PROTO=UDP SPT=19 DPT=1417 LEN=5835 
Aug 29 23:20:54 SRC=163.22.52.1 LEN=1714 TOS=0x00 PREC=0x00 TTL=110 ID=31071 PROTO=UDP SPT=19 DPT=1417 LEN=1694 
Aug 29 23:20:55 SRC=64.132.70.242 LEN=5296 TOS=0x00 PREC=0x00 TTL=121 ID=2266 PROTO=UDP SPT=19 DPT=1417 LEN=5276 
Aug 29 23:20:58 SRC=71.159.172.110 LEN=1604 TOS=0x00 PREC=0x00 TTL=111 ID=36670 PROTO=UDP SPT=19 DPT=1417 LEN=1584 
Aug 29 23:20:58 SRC=217.116.182.233 LEN=1568 TOS=0x00 PREC=0x00 TTL=120 ID=14488 PROTO=UDP SPT=19 DPT=1417 LEN=1548 
Aug 29 23:21:03 SRC=72.22.0.195 LEN=1514 TOS=0x00 PREC=0x00 TTL=110 ID=16755 PROTO=UDP SPT=19 DPT=1417 LEN=1494 
Aug 29 23:21:05 SRC=220.168.205.44 LEN=3555 TOS=0x00 PREC=0x00 TTL=106 ID=11787 PROTO=UDP SPT=19 DPT=1417 LEN=3535 
Aug 29 23:21:08 SRC=207.35.85.240 LEN=1537 TOS=0x00 PREC=0x00 TTL=112 ID=23845 PROTO=UDP SPT=19 DPT=1417 LEN=1517 
Aug 29 23:21:09 SRC=61.133.215.55 LEN=6726 TOS=0x00 PREC=0x00 TTL=105 ID=53319 PROTO=UDP SPT=19 DPT=1417 LEN=6706 
Aug 29 23:21:10 SRC=61.52.254.182 LEN=4685 TOS=0x00 PREC=0x00 TTL=109 ID=7802 PROTO=UDP SPT=19 DPT=1417 LEN=4665 
Aug 29 23:21:13 SRC=212.80.52.16 LEN=5565 TOS=0x00 PREC=0x00 TTL=121 ID=30655 PROTO=UDP SPT=19 DPT=1417 LEN=5545 
Aug 29 23:21:18 SRC=116.255.131.224 LEN=2044 TOS=0x00 PREC=0x00 TTL=105 ID=26490 PROTO=UDP SPT=19 DPT=1417 LEN=2024 
Aug 29 23:21:26 SRC=113.252.5.215 LEN=4039 TOS=0x00 PREC=0x00 TTL=103 ID=25785 PROTO=UDP SPT=19 DPT=1417 LEN=4019 
Aug 29 23:21:29 SRC=58.138.192.78 LEN=5915 TOS=0x00 PREC=0x00 TTL=106 ID=15507 PROTO=UDP SPT=19 DPT=1417 LEN=5895 
Aug 29 23:21:29 SRC=67.175.214.143 LEN=6303 TOS=0x00 PREC=0x00 TTL=114 ID=43119 PROTO=UDP SPT=19 DPT=1417 LEN=6283 
Aug 29 23:21:30 SRC=62.3.236.20 LEN=1565 TOS=0x00 PREC=0x00 TTL=115 ID=42292 PROTO=UDP SPT=19 DPT=1417 LEN=1545 
Aug 29 23:21:30 SRC=122.117.4.164 LEN=2246 TOS=0x00 PREC=0x00 TTL=50 ID=42488 PROTO=UDP SPT=19 DPT=1417 LEN=2226 
Aug 29 23:21:32 SRC=123.242.159.9 LEN=3513 TOS=0x00 PREC=0x00 TTL=108 ID=3672 PROTO=UDP SPT=19 DPT=1417 LEN=3493 
Aug 29 23:21:32 SRC=71.90.239.123 LEN=3388 TOS=0x00 PREC=0x00 TTL=106 ID=6825 PROTO=UDP SPT=19 DPT=1417 LEN=3368 
Aug 29 23:21:32 SRC=58.96.111.36 LEN=4522 TOS=0x00 PREC=0x00 TTL=100 ID=8679 PROTO=UDP SPT=19 DPT=1417 LEN=4502 
Aug 29 23:21:38 SRC=166.111.96.192 LEN=2493 TOS=0x00 PREC=0x00 TTL=36 ID=18254 PROTO=UDP SPT=19 DPT=1417 LEN=2473 
Aug 29 23:21:41 SRC=58.59.176.121 LEN=3240 TOS=0x00 PREC=0x00 TTL=41 ID=16185 PROTO=UDP SPT=19 DPT=1417 LEN=3220 
Aug 29 23:21:44 SRC=68.105.250.19 LEN=6315 TOS=0x00 PREC=0x00 TTL=113 ID=54440 PROTO=UDP SPT=19 DPT=1417 LEN=6295 
Aug 29 23:21:46 SRC=217.113.206.64 LEN=6738 TOS=0x00 PREC=0x00 TTL=115 ID=41120 PROTO=UDP SPT=19 DPT=1417 LEN=6718 
Aug 29 23:21:55 SRC=61.221.28.194 LEN=1937 TOS=0x00 PREC=0x00 TTL=113 ID=55495 PROTO=UDP SPT=19 DPT=1417 LEN=1917 
Aug 29 23:21:56 SRC=211.144.35.81 LEN=1998 TOS=0x00 PREC=0x00 TTL=107 ID=5653 PROTO=UDP SPT=19 DPT=1417 LEN=1978 
Aug 29 23:22:00 SRC=221.131.76.85 LEN=1518 TOS=0x08 PREC=0x20 TTL=113 ID=3352 PROTO=UDP SPT=19 DPT=1417 LEN=1498 
Aug 29 23:22:27 SRC=122.169.249.86 LEN=2998 TOS=0x00 PREC=0x00 TTL=119 ID=40721 PROTO=UDP SPT=19 DPT=1417 LEN=2978

as of now (january 2013) our probes keep detecing chargen scans…
there are multiple hosts around scanning the whole internet searching for vulnerable servers:

Dec  8 04:20:18 SRC=94.102.51.192 LEN=29 TOS=0x10 PREC=0x00 TTL=60 ID=0 DF PROTO=UDP SPT=35900 DPT=19 LEN=9
Dec  8 04:20:18 SRC=50.7.239.188 LEN=29 TOS=0x10 PREC=0x00 TTL=58 ID=0 DF PROTO=UDP SPT=34651 DPT=19 LEN=9
Dec  8 04:20:18 SRC=94.228.220.91 LEN=29 TOS=0x10 PREC=0x00 TTL=58 ID=0 DF PROTO=UDP SPT=53085 DPT=19 LEN=9
Dec  8 04:20:18 SRC=94.102.49.33 LEN=29 TOS=0x10 PREC=0x00 TTL=60 ID=0 DF PROTO=UDP SPT=46052 DPT=19 LEN=9
Dec 22 01:31:42 SRC=37.221.166.43 LEN=29 TOS=0x10 PREC=0x00 TTL=57 ID=0 DF PROTO=UDP SPT=37116 DPT=19 LEN=9
Dec 27 14:15:35 SRC=109.235.50.246 LEN=29 TOS=0x10 PREC=0x00 TTL=58 ID=0 DF PROTO=UDP SPT=38563 DPT=19 LEN=9
Jan  3 07:27:17 SRC=188.165.73.249 LEN=30 TOS=0x10 PREC=0x00 TTL=125 ID=8776 PROTO=UDP SPT=12234 DPT=19 LEN=10

no wonder there are two ecatel.nl IP (94.102.51.192 & 94.102.49.33) scanning the NET… someone said spoofing? LOL