While analyzing a Wireshark capture, I noticed that a large majority of hosts on my network were making MANY UDP connections to port 6666. After a quick Google search, I learned this port is commonly used as backdoor Trojan. Also, all connections on this port were to destination ip 255.255.255.255 meaning the entire network. I’ve heard that port 6666 is a common IRC port, but no one on my network is using IRC. Any ideas?