UDP traffic to EC2

[sunil.somarajan]

I am observing traffice from my FX30s to EC2
12:57:08.087175 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 41
12:57:08.394272 IP ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686 > 10.147.210.65.56830: UDP, length 45
12:57:08.426521 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 64
12:57:08.729800 IP ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686 > 10.147.210.65.56830: UDP, length 49
12:57:08.771775 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 79
13:10:34.776376 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 99
13:10:35.609045 IP ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686 > 10.147.210.65.56830: UDP, length 60
13:10:35.610138 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 131
13:10:35.932308 IP ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686 > 10.147.210.65.56830: UDP, length 162
13:10:35.933998 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 14
13:10:35.934425 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 53
13:10:36.935578 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 51
13:10:37.464602 IP ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686 > 10.147.210.65.56830: UDP, length 37
13:10:37.555391 IP ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686 > 10.147.210.65.56830: UDP, length 45
13:10:37.586208 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 341
13:10:37.860159 IP ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686 > 10.147.210.65.56830: UDP, length 45
13:10:37.955439 IP 10.147.210.65.56830 > ec2-52-17-142-62.eu-west-1.compute.amazonaws.com.5686: UDP, length 159

What traffic is this going into 56830 and 5686 ?

We have no application that is communicating with AWS. There is quite a lot of UDP traffic per day

[jyijyi]

You can capture wireshark log on the module

View pings sent from an external device to mangoh red

@jyijyi Is there a step by step process you can provide?

You might also shut down legato to see if this is related to legato stuff.
Or you can start the application one by one to see which application is generating the traffic.