Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Port 27015 (tcp/udp) Attack Activity Port 27015 (tcp/udp) Attack Activity

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
[get complete service list]
Port Information
Protocol Service Name
udp halflife Half-Life Game Server
Top IPs Scanning
TodayYesterday (136) (100) (20) (75) (15) (45) (15) (44) (14) (40) (10) (38) (9) (38) (9) (36) (8) (35) (7) (34)
User Comments
Submitted By Date
2016-02-11 01:32:26
This port has been lately used for amplification attacks
2014-08-09 19:48:13
Port used by AppleMobileDeviceService.exe likely installed with ITunes. Listens on ports 1028, 1029, 27015, 52815, 52816.
Jack - Creator, Owner and Webmaster - 2011-06-29 14:35:47
As an indie developer of three years in C++, HTML, CSS, PHP, XML and JavaScript, I've done a lot of network programming. In C++, Winsock 2 examples on MSDN use 27015 as the default port. This may contribute to the traffic.
2010-07-07 12:49:22
Default port for online gaming with Half Life games, like HL2:DM TF2 CS:S.
recep 2009-10-04 18:30:22
half life server için
2009-02-09 15:56:51
This port was commonly used by warez FTP servers in the late 1990s.
Jop 2006-01-07 00:31:35
Due to ISP's throttling or blocking traffic that use the standard Bittorent port, many users have changed the port their torrent client uses to 27000, 27015 and 27500. Some torrent web sites force users to change the port otherwise they cannot connect to the tracker. I assume that these ports were suggested on a support forum or FAQ, hence the popularity of these particular ports amongst torrent users.
Mark R. White 2005-03-26 02:47:51
I personally run a Counter Strike server (half life mod) I know that since Half-Life 2 and Counter Strike Source have come out I've seen a significant decrease in traffic to original Half-Life and Counter Strike servers. Also, I know that with the onslaught of Valve's Steam product, the option to buy Half-Life 2 and all of its mods such as Counter Strike Source is at a userís fingertips. My assumption is that the new release of Half-Life 2 and the numbers of copies Sierra/Valve is now selling it is pushing the amount of traffic on port 27015 way up, which is the standard port for all HL and HL2 connections.
Andy Platt 2004-10-11 17:51:34
I suspect the activity has increased because Valve (authors of HalfLife and HalfLife2) have just started selling HalfLife2 packages via their software distribution software "Steam". Some of the packages you can buy include "back-catalogue" games like the original Half Life, which get downloaded and installed on your PC automatically when you purchase them. I think a lot of people (myself included) have probably been playing Half Life for the first time in years since last Thursday after buying it and suddenly finding it installed on their machines. There's a lot of people out there desperate for Half Life 2 and maybe playing Half Life 1 makes the wait soemewhat easier. Glad I'm not that sad. (Oh, hang on, I am that sad individual!) :-)
2004-02-21 09:49:10
port 27015 is the default port for the popular online game Halflife and mods such as Counterstrike and Day of Defeat. Why this port activity has increased, I do not know. When a user looks for a game to join, a game browser pings all known servers that are running the game. The ping is displayed, the player joins based on ping value. The lower the ping the better.
Add a comment
CVE Links
CVE # Description