From owner-freebsd-questions@FreeBSD.ORG  Fri Sep  5 18:26:44 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 81AC61065672
	for <freebsd-questions@freebsd.org>;
	Fri,  5 Sep 2008 18:26:44 +0000 (UTC)
	(envelope-from peter@boosten.org)
Received: from smtpq1.tilbu1.nb.home.nl (smtpq1.tilbu1.nb.home.nl
	[213.51.146.200])
	by mx1.freebsd.org (Postfix) with ESMTP id 420698FC13
	for <freebsd-questions@freebsd.org>;
	Fri,  5 Sep 2008 18:26:44 +0000 (UTC)
	(envelope-from peter@boosten.org)
Received: from [213.51.146.190] (port=55924 helo=smtp1.tilbu1.nb.home.nl)
	by smtpq1.tilbu1.nb.home.nl with esmtp (Exim 4.60)
	(envelope-from <peter@boosten.org>) id 1Kbfay-0004v0-Ez
	for freebsd-questions@freebsd.org; Fri, 05 Sep 2008 19:59:44 +0200
Received: from cp268254-a.landg1.lb.home.nl ([84.25.65.88]:10526
	helo=ra.egypt.nl) by smtp1.tilbu1.nb.home.nl with esmtp (Exim 4.60)
	(envelope-from <peter@boosten.org>) id 1Kbfax-0007Fc-VJ
	for freebsd-questions@freebsd.org; Fri, 05 Sep 2008 19:59:44 +0200
Received: from [127.0.0.1] (xp.egypt.nl [192.168.13.35])
	by ra.egypt.nl (Postfix) with ESMTP id 39EAB39887
	for <freebsd-questions@freebsd.org>;
	Fri,  5 Sep 2008 19:59:43 +0200 (CEST)
Message-ID: <48C1738E.8030206@boosten.org>
Date: Fri, 05 Sep 2008 19:59:42 +0200
From: Peter Boosten <peter@boosten.org>
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: FreeBSD Questions <freebsd-questions@freebsd.org>
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Spam-Score: -0.0 (/)
Subject: Strange traffic originating from httpd
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Sep 2008 18:26:44 -0000

Hi all,

Just today I noticed some strange UDP4 traffic from my webserver to an
IP address unknown to me, connecting to port 8000 (UDP).

Sockstat showed httpd (running as www) as the culprit.
Does anyone know what could cause this?

I run several websites (Joomla, Wordpress, Coppermine, Nucleus), so
maybe some plugin does this.

My setup:

FreeBSD 7 patch 4
Apache 2.2.9_3 (from ports)
PHP5.2.6 (not from ports)

Thanks in advance for your answers.

-- 
http://www.boosten.org