This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 88%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
we noticed on our firewall that yesterday our computer started to send packets to random IP's over the 7680 WUDO port
the ip's are random and blocked
96.49.20.217
172.17.179.1
192.168.137.1
plus a bunch of others we have created a policy to disable update optimization but we are still seeing pc's reach out to weird ip's
what is this behavior, our systems are window 10 ltsc 1809 and 21h2 and none of the ip's are on my local network they are all trying to go out to the internet
we are thinking it might be malicious behavior
we have run many products to try and detect if there is anything on the box everything comes up with nothing.
we have engaged a CIRT to scan but so far, we are coming up with nothing
that was a small sample of IPS' there are many some private some public all blocked by our Firewall
we see no ill effect from this traffic either it is a change in our normal traffic patterns, and we are wondering if Microsoft or 365 made any changes that might affect port 7680
Hi Mike,
From a quick look at it, the 172.x and 192.x are private IP addresses so I'm not sure if you have a private network set up with 172.17.x.x and 192.168.x.x, but it might be trying to reach out to computers that are on the network. The 96.49.20.217 looks like it is an Public IP address but is not registered to Microsoft.
I'd probably recommend wiping that computer as it may be infected.
If this is helpful please accept answer.
