3 ms·
That is what we like to call the background noise of the internet. Scanners are always scanning. Try this as an experiment sometime: make a brand new instance o
by openasocket 10y ago
That is what we like to call the background noise of the internet. Scanners are always scanning. Try this as an experiment sometime: make a brand new instance on your favorite cloud provider, and just run tcpdump on it for a few hours. You'll see all kinds of cool things: from people scanning for HTTP, Telnet, people scanning for SSH servers with weak passwords, router exploits with shellcode embedded in a UDP packet, back-scatter from DDoS attacks, cool stuff. Honestly looking at each packet and trying to figure out what's going on is a pretty great way to learn.
- CapacitorSet 10y agoIf you want to study the background noise, I think you would have better luck reacting to it - as well as running tcpdump, set up a trivial HTTP and SSH server and observe the interactions.
- ge96 10y agoI'll have to lookup TCP dump, I wrote a basic ip-incoming-request tracker and also sometimes see the error log. it is crazy to just randomly try different octet combinations to form a new ip and see what you get... what about ipv6 hoho thanks
- ge96 10y agoI did trace one of them and it lead to some "what appears to be" fake cloud provider. It had a cliche login form/company name but it didn't seem legit. I'm not sure if it's possible to "bounce off" an attack from someone else's ip, by "attack" I mean a specific requested URL that is looking for an exploit.
- narrowrail 10y agoURLs don't request things on the internet, IPs do. This may also be a good read: https://en.wikipedia.org/wiki/Reflection_attack https://en.wikipedia.org/wiki/Reflection_attack
- ge96 10y agoThanks for the clarification and the good read.