# A Problem About UDP port 80 **URL:** \ **Category:** Elasticsearch\ **Created:** [July 9, 2014, 8:45am UTC](https://discuss.elastic.co/t/a-problem-about-udp-port-80/18550 "2014-07-09T08:45:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![umutcan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umutcan/32/625_2.png) [@umutcan](https://discuss.elastic.co/u/umutcan)\ **Post date:** [July 9, 2014, 8:45am UTC](https://discuss.elastic.co/t/a-problem-about-udp-port-80/18550/1 "2014-07-09T08:45:30Z")
Hi, We have been testing Elasticsearch for a while. Our ES cluster was on AWS. We installed Bigdesk, Marvel, Thrift, EC2 Discovery plugins. There were 5 instance (1 load balancer, 4 data node) and all of them were version 0.90. Yesterday, We have received an e-mail from AWS. They said one of our instance in ES cluster was making DOS attacks from UDP port 80. We did not restrict ports, because it was an test cluster. It can be main cause of this problem, but I still want to ask if there is a known bug (in ES or modules or plugins) that cause something like this or if there is anyone who have seen some kind of similar problem. Thanks, Umutcan Onal -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/53BD012A.2090109%40gamegos.com](https://groups.google.com/d/msgid/elasticsearch/53BD012A.2090109%40gamegos.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 9, 2014, 9:01am UTC](https://discuss.elastic.co/t/a-problem-about-udp-port-80/18550/2 "2014-07-09T09:01:12Z")
3 bad things here: - You exposed your cluster to internet directly - You did not disable dynamic scripting - May be you are running your elasticsearch node as root? You should read that documentation: [http://www.elasticsearch.org/guide/en/elasticsearch/reference/0.90/modules-scripting.html#\_disabling\_dynamic\_scripts](http://www.elasticsearch.org/guide/en/elasticsearch/reference/0.90/modules-scripting.html#_disabling_dynamic_scripts) -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr Le 9 juillet 2014 à 10:45:30, Umutcan ([umutcan@gamegos.com](mailto:umutcan@gamegos.com)) a écrit: Hi, We have been testing Elasticsearch for a while. Our ES cluster was on AWS. We installed Bigdesk, Marvel, Thrift, EC2 Discovery plugins. There were 5 instance (1 load balancer, 4 data node) and all of them were version 0.90. Yesterday, We have received an e-mail from AWS. They said one of our instance in ES cluster was making DOS attacks from UDP port 80. We did not restrict ports, because it was an test cluster. It can be main cause of this problem, but I still want to ask if there is a known bug (in ES or modules or plugins) that cause something like this or if there is anyone who have seen some kind of similar problem. Thanks, Umutcan Onal -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/53BD012A.2090109%40gamegos.com](https://groups.google.com/d/msgid/elasticsearch/53BD012A.2090109%40gamegos.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local](https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![umutcan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umutcan/32/625_2.png) [@umutcan](https://discuss.elastic.co/u/umutcan)\ **Post date:** [July 9, 2014, 9:39am UTC](https://discuss.elastic.co/t/a-problem-about-udp-port-80/18550/3 "2014-07-09T09:39:30Z")
You are right. We were aware that exposing cluster to internet was a bad idea. It was a temporary situation. We are planing to use it behind an application in our product. Thanks for advice. On 09-07-2014 12:01, David Pilato wrote: > 3 bad things here: > > - You exposed your cluster to internet directly > - You did not disable dynamic scripting > - May be you are running your elasticsearch node as root? > > You should read that documentation: > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/0.90/modules-scripting.html#_disabling_dynamic_scripts) > > -- > _David Pilato_ | /Technical Advocate/ | _[Elasticsearch.com](http://Elasticsearch.com)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr > [https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > > Le 9 juillet 2014 à 10:45:30, Umutcan ([umutcan@gamegos.com](mailto:umutcan@gamegos.com) > [mailto:umutcan@gamegos.com](mailto:umutcan@gamegos.com)) a écrit: > > > Hi, > > > > We have been testing Elasticsearch for a while. Our ES cluster was on > > AWS. We installed Bigdesk, Marvel, Thrift, EC2 Discovery plugins. There > > were 5 instance (1 load balancer, 4 data node) and all of them were > > version 0.90. > > > > Yesterday, We have received an e-mail from AWS. They said one of our > > instance in ES cluster was making DOS attacks from UDP port 80. > > > > We did not restrict ports, because it was an test cluster. It can be > > main cause of this problem, but I still want to ask if there is a known > > bug (in ES or modules or plugins) that cause something like this or if > > there is anyone who have seen some kind of similar problem. > > > > Thanks, > > Umutcan Onal > > > > -- > > You received this message because you are subscribed to the Google > > Groups "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, > > send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/53BD012A.2090109%40gamegos.com](https://groups.google.com/d/msgid/elasticsearch/53BD012A.2090109%40gamegos.com). > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > > You received this message because you are subscribed to the Google > > Groups "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send > > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com) > > [mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local](https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local) > > [https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local?utm_medium=email&utm_source=footer). > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/53BD0DD2.5080400%40gamegos.com](https://groups.google.com/d/msgid/elasticsearch/53BD0DD2.5080400%40gamegos.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [July 9, 2014, 5:59pm UTC](https://discuss.elastic.co/t/a-problem-about-udp-port-80/18550/4 "2014-07-09T17:59:26Z")
Elasticsearch wrote a blog post regarding the issue today: > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. -- Ivan On Wed, Jul 9, 2014 at 2:39 AM, Umutcan [umutcan@gamegos.com](mailto:umutcan@gamegos.com) wrote: > You are right. We were aware that exposing cluster to internet was a bad > idea. It was a temporary situation. We are planing to use it behind an > application in our product. > > Thanks for advice. > > On 09-07-2014 12:01, David Pilato wrote: > > 3 bad things here: > > - You exposed your cluster to internet directly > - You did not disable dynamic scripting > - May be you are running your elasticsearch node as root? > > You should read that documentation: > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/0.90/modules-scripting.html#_disabling_dynamic_scripts) > > ``` > -- > > ``` > > _David Pilato_ | _Technical Advocate_ | _[Elasticsearch.com](http://Elasticsearch.com)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr > [https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > > Le 9 juillet 2014 à 10:45:30, Umutcan ([umutcan@gamegos.com](mailto:umutcan@gamegos.com)) a écrit: > > Hi, > > We have been testing Elasticsearch for a while. Our ES cluster was on > AWS. We installed Bigdesk, Marvel, Thrift, EC2 Discovery plugins. There > were 5 instance (1 load balancer, 4 data node) and all of them were > version 0.90. > > Yesterday, We have received an e-mail from AWS. They said one of our > instance in ES cluster was making DOS attacks from UDP port 80. > > We did not restrict ports, because it was an test cluster. It can be > main cause of this problem, but I still want to ask if there is a known > bug (in ES or modules or plugins) that cause something like this or if > there is anyone who have seen some kind of similar problem. > > Thanks, > Umutcan Onal > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/53BD012A.2090109%40gamegos.com](https://groups.google.com/d/msgid/elasticsearch/53BD012A.2090109%40gamegos.com) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local](https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local) > [https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/etPan.53bd04d9.189a769b.6455%40MacBook-Air-de-David.local?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/53BD0DD2.5080400%40gamegos.com](https://groups.google.com/d/msgid/elasticsearch/53BD0DD2.5080400%40gamegos.com) > [https://groups.google.com/d/msgid/elasticsearch/53BD0DD2.5080400%40gamegos.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/53BD0DD2.5080400%40gamegos.com?utm_medium=email&utm_source=footer) > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQBxE6KnZb5Art%2B%3DKMiVSQBcOChDaVsnnDoJAxdNCanLTA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQBxE6KnZb5Art%2B%3DKMiVSQBcOChDaVsnnDoJAxdNCanLTA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:16am UTC](https://discuss.elastic.co/t/a-problem-about-udp-port-80/18550/5 "2017-07-06T01:16:58Z")