The Boston Diaries

The ongoing saga of a programmer who doesn't live in Boston, nor does he even like Boston, but yet named his weblog/journal “The Boston Diaries.”

Go figure.

Thursday, January 26, 2006

Oh, it's still useful, just not as useful as I expected

By using ltpstat I've been able to see that the LaBrea tarpit isn't quite as effective as I first thought. Yes, it does slow down scans, but not quite as much as one thinks. I'm guessing that scanning software now includes the “timeout” concept—if a connection takes too long, drop the connection and move on.

A few days ago I added a feature to ltpstat to remove entries that have not seen any activity for over an hour (default setting). After running the tarpit for over a day, I see the following stats:

Jan 27 01:57:08 ltp ltp-report: Start: Wed Jan 25 17:27:55 2006 End: Fri Jan 27 01:57:08 2006 Running time:  1d 8h 29m 13s
Jan 27 01:57:08 ltp ltp-report: Pool-max: 1048576
Jan 27 01:57:08 ltp ltp-report: Pool-num: 107287
Jan 27 01:57:08 ltp ltp-report: Rec-max:  1048576
Jan 27 01:57:08 ltp ltp-report: Rec-num:  107287
Jan 27 01:57:08 ltp ltp-report: UIP-max:  1048576
Jan 27 01:57:08 ltp ltp-report: UIP-num:  2558
Jan 27 01:57:08 ltp ltp-report: Reported-bandwidth: 32 (Kb/sec)

Okay, I've “captured” 107,287 connections. But how many of those are still active?

Jan 27 01:58:32 ltp ltp-report: Removing records with no activity for the past  1h
Jan 27 01:58:32 ltp ltp-report: ... keeping 11180 records with activity since Fri Jan 27 00:58:31 2006

Well then. Over 96,000 connections were no longer “active” and of the 2,558 machines doing the scanning, some 2,200 had moved on.

So it looks like the LaBrea tar pit is really only useful to see what's being attacked, and which machines on the Internet are really doing the attacking (so far, 24.73.129.197 seems to be quite tenacious in scanning).

And the ports being scanned? Again, it's the Microsoft specific ports as usual. No use making a chart this time.

Obligatory Picture

[It's the most wonderful time of the year!]

Obligatory Contact Info

Obligatory Feeds

Obligatory Links

Obligatory Miscellaneous

You have my permission to link freely to any entry here. Go ahead, I won't bite. I promise.

The dates are the permanent links to that day's entries (or entry, if there is only one entry). The titles are the permanent links to that entry only. The format for the links are simple: Start with the base link for this site: http://boston.conman.org/, then add the date you are interested in, say 2000/08/01, so that would make the final URL:

http://boston.conman.org/2000/08/01

You can also specify the entire month by leaving off the day portion. You can even select an arbitrary portion of time.

You may also note subtle shading of the links and that's intentional: the “closer” the link is (relative to the page) the “brighter” it appears. It's an experiment in using color shading to denote the distance a link is from here. If you don't notice it, don't worry; it's not all that important.

It is assumed that every brand name, slogan, corporate name, symbol, design element, et cetera mentioned in these pages is a protected and/or trademarked entity, the sole property of its owner(s), and acknowledgement of this status is implied.

Copyright © 1999-2021 by Sean Conner. All Rights Reserved.