This weekend has been pretty smooth with respect to security incidents, so I thought I would show everybody what my DShield sensor is telling me about the unsolicited packets coming to my home network. I've been submitting packets to DShield for nearly 10 years so I've got a lot of historical data I can look back through. This is very helpful when trying to figure out if something is new, or if it's been here before. Here's what my report from yesterday (November 20, 2010) said: Day: 2010-11-20 As you can see, I've got a lot of unsolicited Bit Torrent traffic, and quite a few intruders trying to telnet into my home system. All of these packets are dropped by my firewall, logged, then sent to DShield once an hour. In a perfect world I would not be seeing any SYN packets coming at my house since I'm not running any servers here. The large number of Bit Torrent is troubling, but I'm sure that it's because whoever owned the dynamic IP assigned to me was a Bit Torrent user and all of his peers are trying to reconnect. So what does your home DShield report look like? Getting anything you should not be seeing? In fact, are you submitting DShield data from your home network? If not, please do so! We can use all of the packets we can get, and doing this at home is a snap. The instructions are on the DShield site, and if you have any questions just let us know. We run a discussion list on Google Groups, so be sure to sign up for that too. Let us know how you use DShield via the comment link below. Marcus H. Sachs |
Marcus 301 Posts ISC Handler Nov 21st 2010 |
Thread locked Subscribe |
Nov 21st 2010 1 decade ago |
A static DSL IP helps a lot to avoid rogue p2p traffic
![]() My IDS logs show the usual web exploits (mostly forum hax), spam relay searchers, and what disturbs me a bit: an ever increasing amount of ssh bruteforcing, mostly from sources in .ru and .edu. Shouldn't the latter have a decent level of network security? Seems several unis have wired their dorm networks directly to the 'net. Annoying, to say the least. If my router logs were a bit more machine parseable, I'd dshield them.. |
Anonymous |
Quote |
Nov 22nd 2010 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!