3 ms·

BTW does anyone know what is a strain on the Internet bones when thousands of script kiddies try to run it?

jacquesm 6y ago
Negligible compared to the existence of Youtube, Spotify, Twitch, Facebook and so on.
st_goliath 6y ago
If you are running this tool, you are sending packets from a single machine to N remote hosts, so logically the strain and bottleneck should be at your end and I can't see how this should cause much of a burden several hops away. At the destination this should be a small fraction of the usual "Internet background noise" which is usually a negligible fraction of the available bandwidth.
- m463 6y ago
  I wonder if you can randomize the source address?
  - zxcmx 6y ago
    Not exactly. You can separate transmit and receive IPs, if your tx network does not implement source filtering. So you can tx from one place and receive from one or more other places "sensors" that you use to receive SYN-ACKs. You can use several (an arbitrary number) of spoofed source IPs on tx to hide your "real" rx IPs, at the cost of more egress traffic. There is a technique involving ipids (idle scanning) you can use which does not reveal your IP at all but it is not reliable; read: not usable beyond very tiny scale. You could put a lot of effort into it but it's not worth it. Nobody beyond a few vociferous cranks _really_ cares about IP scanning. The real way to stay off radars (eg dshield) while mass scanning is have a ton of unrelated IPs and scan as slow as you can stand. This assumes good randomization (not obviously striping across networks from the same IP).
raesene9 6y ago
Individual users running massscan et al, are not going to produce anything like the level of traffic all the major providers (and quite a few sitest that aren't that large) see from DDoS attacks on a pretty regular basis. Given that there are several sites who scan the Internet regularly for more than just open ports (e.g. Shodan, Binary Edge, Censys) it's not a volume of traffic that should cause a concern.

Negligible compared to the existence of Youtube, Spotify, Twitch, Facebook and so on.

If you are running this tool, you are sending packets from a single machine to N remote hosts, so logically the strain and bottleneck should be at your end and I can't see how this should cause much of a burden several hops away. At the destination this should be a small fraction of the usual "Internet background noise" which is usually a negligible fraction of the available bandwidth.

m463 6y ago
I wonder if you can randomize the source address?
- zxcmx 6y ago
  Not exactly. You can separate transmit and receive IPs, if your tx network does not implement source filtering. So you can tx from one place and receive from one or more other places "sensors" that you use to receive SYN-ACKs. You can use several (an arbitrary number) of spoofed source IPs on tx to hide your "real" rx IPs, at the cost of more egress traffic. There is a technique involving ipids (idle scanning) you can use which does not reveal your IP at all but it is not reliable; read: not usable beyond very tiny scale. You could put a lot of effort into it but it's not worth it. Nobody beyond a few vociferous cranks _really_ cares about IP scanning. The real way to stay off radars (eg dshield) while mass scanning is have a ton of unrelated IPs and scan as slow as you can stand. This assumes good randomization (not obviously striping across networks from the same IP).

raesene9 6y ago

Individual users running massscan et al, are not going to produce anything like the level of traffic all the major providers (and quite a few sitest that aren't that large) see from DDoS attacks on a pretty regular basis. Given that there are several sites who scan the Internet regularly for more than just open ports (e.g. Shodan, Binary Edge, Censys) it's not a volume of traffic that should cause a concern.