Quite. My firm have a Nessus scanner and we point it at ourselves as well as our customers. There are also several checks on the monitoring system that will f

Quite. My firm have a Nessus scanner and we point it at ourselves as well as our customers. There are also several checks on the monitoring system that will flag if something suddenly starts working. Background radiation is about right. Run up a honeypot VM with a web service on it and watch the logs with something like lnav. You soon get a feel for how fast the legitimate (and I use that term advisedly) crawlers like Google and that rock up along with the others. You will see a lot of hits from things with a Github link within their agent header - script kiddies or perhaps clever kiddies pretending to be script kiddies - more analysis needed. You will also see hits from agents claiming to be Google or Bing or Firefox on Commodore 64. Again, careful packet analysis, IP lists etc can be instructive ... if you can be arsed. Anyway. Humans cannot see network traffic. When you instruct your firewall to do something via its GUI or CLI you are merely providing instructions that may or may not actually do anything. Do feel free to actually test it. nmap, for example, is available for port testing and much, much more.