Shadow server apears to have been poking around again. This time for UDP port 623. In other works IPMI, asf-rmcp 623/udp ASF Remote Management and Control Protocol My guess is with the recent announcements of IPMI vulns, they are poking to see what may be a problem. Start End Sif SrcIPaddress SrcP DIf DstIPaddress DstP P Fl Pkts Octets 0728.02:02:57.480 0728.02:02:57.480 6 71.6.216.49 49092 3 192.5.186.76 623 17 0 2 102 0728.02:02:57.473 0728.02:02:57.473 6 192.5.186.76 623 3 71.6.216.49 49092 17 0 2 116 0728.15:00:29.468 0728.15:00:29.468 6 71.6.216.49 40825 3 192.5.186.80 623 17 0 2 58 0728.22:42:40.702 0728.22:42:40.702 5 184.105.247.238 41619 3 192.5.186.79 623 17 0 2 102 0728.22:42:40.747 0728.22:42:40.747 6 192.5.186.79 623 3 184.105.247.238 41619 17 0 2 116 0729.23:17:43.465 0729.23:17:43.465 5 184.105.247.250 51163 3 192.5.186.80 623 17 0 2 102 0729.23:17:43.502 0729.23:17:43.502 6 192.5.186.80 623 3 184.105.247.250 51163 17 0 2 116 0730.00:58:44.240 0730.00:58:44.240 5 184.105.247.242 48596 3 192.5.186.79 623 17 0 2 102 0730.00:58:44.290 0730.00:58:44.290 6 192.5.186.79 623 3 184.105.247.242 48596 17 0 2 116 0730.22:38:02.559 0730.22:38:02.559 5 184.105.247.250 47805 3 192.5.186.80 623 17 0 2 102 0730.22:38:02.568 0730.22:38:02.568 6 192.5.186.80 623 3 184.105.247.250 47805 17 0 2 116 0730.23:03:50.334 0730.23:03:50.334 5 184.105.247.250 34362 3 192.5.186.82 623 17 0 2 102 0730.23:03:50.364 0730.23:03:50.364 6 192.5.186.82 623 3 184.105.247.250 34362 17 0 2 116 0730.23:16:26.735 0730.23:16:26.735 5 184.105.247.250 37066 3 192.5.186.79 623 17 0 2 102 0730.23:16:26.785 0730.23:16:26.785 6 192.5.186.79 623 3 184.105.247.250 37066 17 0 2 116 0730.23:33:49.004 0730.23:33:49.004 5 184.105.247.198 36485 3 192.5.186.76 623 17 0 2 102 0730.23:33:50.076 0730.23:33:50.076 6 192.5.186.76 623 3 184.105.247.198 36485 17 0 2 116 The probe from 71.6.216.49 is a "rapid7.com" scanner. A competitor to nessus in may ways.  Claims from shadowserver reports are "timestamp","ip","port","hostname","tag","ipmi_version","asn","geo","region","city","none_auth","md2_auth","md5_auth","passkey_auth","oem_auth","defaultkg","permessage_auth","userlevel_auth","usernames","nulluser","anon_login","error","deviceid","devicerev","firmwarerev","version","manufacturerid","manufacturername","productid","productname" "2014-07-28 02:35:00","192.5.186.79",623,"node0.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, "2014-07-29 03:42:41","192.5.186.79",623,"node0.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, "2014-07-30 04:17:43","192.5.186.80",623,"node1.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, "2014-07-30 05:58:43","192.5.186.79",623,"node0.i2u2.org","ipmi","1.5",683,"US","ILLINOIS","LEMONT","no","no","no","no","yes","-","disabled","disabled","yes","no","no",,,,,,,,, --gene