4 ms·

That's so interesting. I built literally the exact same thing the other weekend. I took all of the data and fed it into a database, then built a web interface

That's so interesting. I built literally the exact same thing the other weekend. I took all of the data and fed it into a database, then built a web interface so I could see the data better. It's looking like this: https://i.imgur.com/8G9GAUp.png https://i.imgur.com/8G9GAUp.png Lots more activity from France than I would have expected compared to other countries. Also lots more people using Amazon's infrastructure to scan the internet than I would have imagined. Other than that it's about what you'd expect. So far I don't find this to be overly practical because with the amount of IP addresses in the filter, the firewall takes forever to reload. (firewalld)

_wldu 7y ago
You can use ipset to block them. It's hash based and efficient. http://ipset.netfilter.org/ http://ipset.netfilter.org/ http://mikhailian.mova.org/node/194 http://mikhailian.mova.org/node/194
JeremyMorgan 7y ago
Awesome, that really looks nice! I'm hoping to build some sort of auto-generated HTML page on my site just for fun. Yours looks great.
- barrkel 7y ago
  Funny, because the first thing I thought was how frustrating it was to read. The %s are not sorted by size in the pie chart, and they're not labelled other than by colour, so you can't read the % for each country. The attempts per hour seems to cover more than 24 hours, but the dates aren't labelled. An aggregate chart bucketed by hour of day would be more interesting, since the actual rate is quite low and has a lot of variance - at this zoom level, it's basically noise. I agree it looks pretty, though I'd take a table with some bar chart columns.
  - kjaftaedi 7y ago
    The charts are interactive, you can hover each slice to get names and percentages, or each name to find it on the chart. I found it wasn't really worth doing more with the chart, since its purpose was really just comparing the largest offenders. Regarding the time frames, the buttons in the top right allow choosing the time frame. today, yesterday, 48 hours, week, month, year. I also slapped this together in half a day.. there is plenty of room for improvement, and more charts and options could easily be added. I didn't take this very far because this was not my goal, it was just a quick idea to allow me to block others from being able to query my server while still allowing me access from anywhere in the world. The visualizations were just for fun.
- twooclock 7y ago
  I made just this for my pet project https://rankfirst.me/ipban.html https://rankfirst.me/ipban.html I'm using ipban and ipgeo.
Theboda 7y ago
Hey, Would you mind to share the code? Would really appreciate it!
- kjaftaedi 7y ago
  I can give you the basics. Parse your log files. If condition met, insert a line into your database. Add extra details with a reverse DNS lookup, and IP location check. I'm using: https://www.geoplugin.com/ https://www.geoplugin.com/ at the moment, but feel like there are probably better alternatives. I then move the data to another log file with a similar name and date so it doesn't get parsed twice, but I keep the data. Then just make a page to pull the data out of the database. This is probably what you are looking for: https://developers.google.com/chart/interactive/docs/gallery https://developers.google.com/chart/interactive/docs/gallery Just do a loop and feed the values into the chart data.
gruez 7y ago
>Lots more activity from France than I would have expected compared to other countries My guess would be the all the cheap server providers there eg. ovh, online.net/scaleway,
olivierduval 7y ago
Mmmm... I'm a bit surprised by France: 3rd country but... first french town is 29th (Lyon, only the 3rd city of the country) and no french subdivision in the top 40 ????? Maybe some cross-checking would be welcomed, because it doesn't seem really consistent. Any explaination ?
- samoa42 7y ago
  probably because of ovh but be warned that such attribution attempts are utterly useless in the end.

_wldu 7y ago

You can use ipset to block them. It's hash based and efficient. http://ipset.netfilter.org/ http://ipset.netfilter.org/ http://mikhailian.mova.org/node/194 http://mikhailian.mova.org/node/194

JeremyMorgan 7y ago

Awesome, that really looks nice! I'm hoping to build some sort of auto-generated HTML page on my site just for fun. Yours looks great.

barrkel 7y ago
Funny, because the first thing I thought was how frustrating it was to read. The %s are not sorted by size in the pie chart, and they're not labelled other than by colour, so you can't read the % for each country. The attempts per hour seems to cover more than 24 hours, but the dates aren't labelled. An aggregate chart bucketed by hour of day would be more interesting, since the actual rate is quite low and has a lot of variance - at this zoom level, it's basically noise. I agree it looks pretty, though I'd take a table with some bar chart columns.
- kjaftaedi 7y ago
  The charts are interactive, you can hover each slice to get names and percentages, or each name to find it on the chart. I found it wasn't really worth doing more with the chart, since its purpose was really just comparing the largest offenders. Regarding the time frames, the buttons in the top right allow choosing the time frame. today, yesterday, 48 hours, week, month, year. I also slapped this together in half a day.. there is plenty of room for improvement, and more charts and options could easily be added. I didn't take this very far because this was not my goal, it was just a quick idea to allow me to block others from being able to query my server while still allowing me access from anywhere in the world. The visualizations were just for fun.
twooclock 7y ago
I made just this for my pet project https://rankfirst.me/ipban.html https://rankfirst.me/ipban.html I'm using ipban and ipgeo.

Theboda 7y ago

Hey, Would you mind to share the code? Would really appreciate it!

kjaftaedi 7y ago
I can give you the basics. Parse your log files. If condition met, insert a line into your database. Add extra details with a reverse DNS lookup, and IP location check. I'm using: https://www.geoplugin.com/ https://www.geoplugin.com/ at the moment, but feel like there are probably better alternatives. I then move the data to another log file with a similar name and date so it doesn't get parsed twice, but I keep the data. Then just make a page to pull the data out of the database. This is probably what you are looking for: https://developers.google.com/chart/interactive/docs/gallery https://developers.google.com/chart/interactive/docs/gallery Just do a loop and feed the values into the chart data.

gruez 7y ago

>Lots more activity from France than I would have expected compared to other countries My guess would be the all the cheap server providers there eg. ovh, online.net/scaleway,

olivierduval 7y ago

Mmmm... I'm a bit surprised by France: 3rd country but... first french town is 29th (Lyon, only the 3rd city of the country) and no french subdivision in the top 40 ????? Maybe some cross-checking would be welcomed, because it doesn't seem really consistent. Any explaination ?

samoa42 7y ago
probably because of ovh but be warned that such attribution attempts are utterly useless in the end.