Friday, January 13, 2006
More updates on the tarpit
Labrea is actually logging about half a gig a day. Over a 24 hour period (from about 6 am Thursday to 6 am today) I'm tarpitting 82,359 connections across 2,059 unique IP addresses (24,252 connections from a single IP address). And while the number of network ports being accessed has increased a bit, it's the Microsoft specific ports that are still the most popular targets (with 72% of the scans):
| Port # | Port description | # connections |
|---|---|---|
| Port # | Port description | # connections |
| 139 | NetBIOS Session Service | 24941 |
| 445 | Microsoft-DS Service | 23013 |
| 1433 | Microsoft SQL Server | 6772 |
| 4899 | Remote Administration | 5620 |
| 135 | Microsoft-RPC service | 4722 |
| 80 | Hypertext Transfer Protocol | 3697 |
| 8080 | Hypertext Transfer Protocol—typical alternative port | 1686 |
| 7212 | (unknown) | 1683 |
| 8000 | (unknown) | 1471 |
| 10000 | (some web based control panels use this port) | 951 |
The program I'm using to generate the stats is written in Perl, and it took about 4 hours to run over a day's worth of data (the machine that does the tarpitting isn't the fastest machine we have, but it's more than enough to dedicate to just running LaBrea). I definitely want to write a program to process LaBrea data in real time.
![[The future's so bright, I gotta wear shades]](https://www.conman.org/people/spc/about/2023/1023.t.jpg "The future's so bright, I gotta wear shades")