logoalt Hacker News

viraptoryesterday at 4:04 PM1 replyview on HN

Support - yes. Turn on without a bit of hassle - no. I'm not sure how they found that many active services. Honestly, at that small percentage I suspect misclassification instead.


Replies

Eridrusyesterday at 5:25 PM

Yeah, I think this is misclassification based on UDP port.

If you take their random source ports (21,925), ~0.004% come from any single port, which lines up with what they said was "Other" traffic. The numbers don't quite work out right, but it seems like its within a factor of 2, so I wouldn't be surprised if it was something like udp source/dest port = 17 => QOTD.