Strange traffic originating from httpd

Peter Boosten peter at
Fri Sep 5 18:38:15 UTC 2008

Quoting "Peter Boosten" <peter at>:

> Hi all,
> Just today I noticed some strange UDP4 traffic from my webserver to an
> IP address unknown to me, connecting to port 8000 (UDP).
> Sockstat showed httpd (running as www) as the culprit.
> Does anyone know what could cause this?
> I run several websites (Joomla, Wordpress, Coppermine, Nucleus), so
> maybe some plugin does this.

Oke, did some checks and found the following:

the UDP connection is initiated once when anyone visits one of the  
Wordpress sites. A tcpdump shows that the IP address of the visiting  
client is transmitted to that external site, so probably it's one of  
the plugins:

- Akismet
- WP-Shortstat
- Wassup
- WPsyslog

I'm going to ask in the Wordpress groups.

Apologies for the polution :-)



More information about the freebsd-questions mailing list