4 ms·

Why do you think this is any easier than just scraping urls off the internet

Quekid5 7y ago
I'm always surprised by the mindset of the person you're replying to. I learned a few years ago from some DEFCON video[0] that someone had figured out a way to do a (basic) port scan of the whole internet in ~1 day (or something like that). Thing is... it really shouldn't have been that surprising. Although network latency isn't getting that much better year by year (c = c), the amount of data you can process in bulk, correlate, etc. is ever-increasing. [0] At least, I think that was the conference.
- nighthawk454 7y ago
  In fact, there's a tool that claims to scan the internet in 6 minutes: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan
  - Quekid5 7y ago
    Yes, thank you, I think that was the one. Only missed by an order of magnitude or so.
  - not_a_cop75 7y ago
    To be fair anything that is sending like this is probably getting you network blocks: "This program spews out packets very fast. On Windows, or from VMs, it can do 300,000 packets/second. On Linux (no virtualization) it'll do 1.6 million packets-per-second. That's fast enough to melt most networks."
  - kayfox 7y ago
    That's probably the DEFCON talk the parent poster is talking about: Massscanning the Internet - Defcon 22 (2014) https://www.youtube.com/watch?v=UOWexFaRylM https://www.youtube.com/watch?v=UOWexFaRylM
- not_a_cop75 7y ago
  Port scanning is a real and established thing that anyone who is even thinking of security has known about normally for decades, but port scans don't tell everyone what your whole stack consists of. Maybe you'd like to share why sharing your stack with everyone is a good idea? I'd really like to know. Thank you.
  - Quekid5 7y ago
    Do you think that fingerprinting is quantitatively different from port scanning? My main point was just that a port scan can immediately identify the 0.1% (or whatever) of the Internet that you're interested in and then try more "invasive" probing. (I should add that I forgot to mention that IpV6 does make the whole "PortScan the Internet" business a tad more complicated, so that's than argument against me.)

I'm always surprised by the mindset of the person you're replying to. I learned a few years ago from some DEFCON video[0] that someone had figured out a way to do a (basic) port scan of the whole internet in ~1 day (or something like that). Thing is... it really shouldn't have been that surprising. Although network latency isn't getting that much better year by year (c = c), the amount of data you can process in bulk, correlate, etc. is ever-increasing. [0] At least, I think that was the conference.

nighthawk454 7y ago
In fact, there's a tool that claims to scan the internet in 6 minutes: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan
- Quekid5 7y ago
  Yes, thank you, I think that was the one. Only missed by an order of magnitude or so.
- not_a_cop75 7y ago
  To be fair anything that is sending like this is probably getting you network blocks: "This program spews out packets very fast. On Windows, or from VMs, it can do 300,000 packets/second. On Linux (no virtualization) it'll do 1.6 million packets-per-second. That's fast enough to melt most networks."
- kayfox 7y ago
  That's probably the DEFCON talk the parent poster is talking about: Massscanning the Internet - Defcon 22 (2014) https://www.youtube.com/watch?v=UOWexFaRylM https://www.youtube.com/watch?v=UOWexFaRylM
not_a_cop75 7y ago
Port scanning is a real and established thing that anyone who is even thinking of security has known about normally for decades, but port scans don't tell everyone what your whole stack consists of. Maybe you'd like to share why sharing your stack with everyone is a good idea? I'd really like to know. Thank you.
- Quekid5 7y ago
  Do you think that fingerprinting is quantitatively different from port scanning? My main point was just that a port scan can immediately identify the 0.1% (or whatever) of the Internet that you're interested in and then try more "invasive" probing. (I should add that I forgot to mention that IpV6 does make the whole "PortScan the Internet" business a tad more complicated, so that's than argument against me.)