Strange traffic originating from httpd

[Peter Boosten]

Quoting "Peter Boosten" <peter at boosten.org>:

> Hi all,
>
> Just today I noticed some strange UDP4 traffic from my webserver to an
> IP address unknown to me, connecting to port 8000 (UDP).
>
> Sockstat showed httpd (running as www) as the culprit.
> Does anyone know what could cause this?
>
> I run several websites (Joomla, Wordpress, Coppermine, Nucleus), so
> maybe some plugin does this.
>
[snip]

Oke, did some checks and found the following:

the UDP connection is initiated once when anyone visits one of the  
Wordpress sites. A tcpdump shows that the IP address of the visiting  
client is transmitted to that external site, so probably it's one of  
the plugins:

- Akismet
- WP-Shortstat
- Wassup
- WPsyslog

I'm going to ask in the Wordpress groups.

Apologies for the polution :-)

Peter

-- 
http://www.boosten.org