[dns-operations] udp/49153

[Duane Wessels]

On Mon, 1 Dec 2008, Sam Norris wrote:

> Just taking a quick poll about dns queries coming in on udp/49153.  Does 
> anyone know what resolver is using this port, and why ?

I ran tcpdump on the OARC nameserver and captured a few but they
dont look like DNS to me:

20:59:46.132091 IP xx.xxx.xxx.xxx.32771 > 149.20.58.65.49153: UDP, length 50
         0x0000:  4500 004e 45dc 0000 3411 b6fc .... ....
         0x0010:  9514 3a41 8003 c001 003a 3d40 6c69 6e6b
         0x0020:  7072 6f6f 662e 7072 6f78 696d 6974 792e
         0x0030:  6164 7661 6e63 6564 0000 0000 0000 0000
         0x0040:  0000 0000 0000 0000 0000 0000 0000

Following the UDP header is the character string "linkproof.proximity.advanced"
which seems to be associated with a product by Radware.

DW