[问题求助]如何进一步分析异常流量 [复制链接]

在用.bandwidthd监测过程中发现某个时段udp流量剧增，有10m.多，主机.只开了http、ftp、ssh、并作为网络设备的log server，请问如何进一步分析原因？    健康

刚刚通过tcpdump抓的包，帮忙分析一下可能原因。谢过……
10:31:06.796409 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.796437 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.796449 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.807441 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.807493 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.807517 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.807543 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.807573 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.807597 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:06.807622 222.35.*.*.47231 >; 207-255-201-169-dhcp.cbe.md.atlanticbb.net.http: udp 15 (DF)
10:31:16.823379 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:16.823408 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:16.823437 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:16.823460 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:16.823482 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:16.823505 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:25.605466 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:25.605520 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:25.605542 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:25.605566 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:25.605588 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:25.605611 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)
10:31:25.605633 222.35.*.*.47218 >; p16-1-0-0.r80.asbnva01.us.bb.verio.net.http: udp 15 (DF)

都是到美国的地址
10:39:42.777234 222.35.*.*.47218 >; 129.250.5.87.http: udp 15 (DF)
10:39:42.777252 222.35.*.*.47218 >; 129.250.5.87.http: udp 15 (DF)
10:39:42.777270 222.35.*.*.47218 >; 129.250.5.87.http: udp 15 (DF)
10:39:42.777290 222.35.*.*.47218 >; 129.250.5.87.http: udp 15 (DF)
10:39:42.777312 222.35.*.*.47218 >; 129.250.5.87.http: udp 15 (DF)
10:39:42.777331 222.35.*.*.47218 >; 129.250.5.87.http: udp 15 (DF)
10:39:42.777345 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777359 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777373 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777387 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777402 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777415 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777429 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777445 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777460 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777474 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)
10:39:42.777486 222.35.*.*.47274 >; 12.216.94.201.http: udp 15 (DF)

有人给回答一下否？

up,希望有人给解决一下