3 ms·
A number of routers can capture every destination address your network has sent data to. You can then go through that list and mark 'safe' the ones where you kn
by ChuckMcM 2y ago
A number of routers can capture every destination address your network has sent data to. You can then go through that list and mark 'safe' the ones where you know where they are going. After about a week you'll go days and days with no new addresses but when one pops up it will be some IoT device or some vistor's phone or something.
- anyfoo 2y agoThis may work for "casual" attempts, but if someone really want to exfiltrate data, they can still do so in any number of ways. For example, they can send DNS queries. To your usual DNS server, so you won't see a new address. Which will happily pass it along to whatever the registered nameserver for the queried domain is.
- ChuckMcM 2y agoAbsolutely correct, any APT won’t be caught this way. But script kiddies will be every day of the week. And if you’re browser is suddenly sending queries to China after that last add-on, it can be a good bread crumb to follow up. Security, like dressing for variable weather, is best done in layers.