outbound UDP port 1

[Maxim Dounin]

Hello!

On Sun, Jun 17, 2018 at 01:36:25AM +0200, Alexander Morozov wrote:

> Hello.
> 
> I was doing experiments with the sandboxing in FreeBSD and I executed 
> nginx sandboxed (in sandbox for FreeBSD) and I noticed that sandbox 
> blocked 2 outbound datagrams from nginx (uid:root) process.
> 
> Jun 17 00:26:02 ** sandboxd[49377]: action: deny for pid[30392]nginx 
> uid:0 procedure: network-outbound[90] network outbound remote 
> udp/ip4:65.158.94.185:1
> Jun 17 00:26:02 ** sandboxd[49377]: action: deny for pid[30392]nginx 
> uid:0 procedure: network-outbound[90] network outbound remote 
> udp/ip4:65.158.94.168:1
> Jun 17 01:17:03 ** sandboxd[49377]: action: deny for pid[61454]nginx 
> uid:0 procedure: network-outbound[90] network outbound remote 
> udp/ip4:205.197.140.171:1
> Jun 17 01:17:03 ** sandboxd[49377]: action: deny for pid[61454]nginx 
> uid:0 procedure: network-outbound[90] network outbound remote 
> udp/ip4:205.197.140.178:1
> Jun 17 01:24:11 ** sandboxd[49377]: action: deny for pid[11326]nginx 
> uid:0 procedure: network-outbound[90] network outbound remote 
> udp/ip4:80.239.148.73:1
> Jun 17 01:24:11 ** sandboxd[49377]: action: deny for pid[11326]nginx 
> uid:0 procedure: network-outbound[90] network outbound remote 
> udp/ip4:80.239.148.95:1
> 
> I can not find any information about this addresses except from whois. 
> For which purpose outgoing UDP/1 is used?

It is not used by nginx unless you've explicitly configured it to 
do so.

-- 
Maxim Dounin
http://mdounin.ru/