homo cum charta peram in capite eius
Hodie, postquam adaequationem Catilinae ab 15.6 ad 15.7, celeritas interreti omissa, aliquid retiaculum meum oneratum erat, et actionem retis inspicere decrevi.
Cucurri tcpdump in duobus horis;
sudo tcpdump -k NP > ~/log
Et primo quod oculus meus captus est;
16:43:42.919443 () ARP, Request who-has 192.168.1.51 tell 192.168.1.1, length 28
16:43:42.927716 () ARP, Request who-has 192.168.1.52 tell 192.168.1.1, length 28
16:43:42.934112 () ARP, Request who-has 192.168.1.53 tell 192.168.1.1, length 28
16:43:42.942328 () ARP, Request who-has 192.168.1.54 tell 192.168.1.1, length 28
16:43:43.021971 () ARP, Request who-has 192.168.1.55 tell 192.168.1.1, length 28
Cur indiget network localis totus? Lustrat eam sine fine perparvis 192.168.1./255, bene, dicamus hoc esse retis navigatri servitium.
(shadowserver.org) - non-lucrum securitatem organization
16:43:33.518282 () IP scan-05l.shadowserver.org.33567 > 192.168.1.150.rsync: Flags [S], seq 1527048226, win 65535, options [mss 536], length 0
Alius pulsator (scanner-12.ch1.censys-scanner.com -> censys.io);
16:44:16.254073 () IP scanner-12.ch1.censys-scanner.com.62651 > 192.168.1.150.8843: Flags [S], seq 1454862354, win 1024, options [mss 1460], length 0
Bene, bene, nihil speciale videtur: analytica, intuens retia localia, bene, rem consuetam, sed quid de hoc:
16:15:56.603292 () IP 45.129.33.152.51777 > 192.168.1.150.jpegmpeg: Flags [S], seq 2349838714, win 1024, options [mss 536], length 0
Si ad hanc IP oratio
Tabularia textuum continent decies centena millia inscriptionum IP cum portubus.
Contenta documenti temp:
[?1h=[?25l[H[J[mtop - 21:17:26 up 31 days, 6:44, 1 use[m[39;49m[m[39;49m[K
Tasks:[m[39;49m[1m 144 [m[39;49mtotal,[m[39;49m[1m 1 [m[39;49mrunning,[m[39;49m[1m 143 [m[39;49msleep[m[39;49m[m[39;49m[K
%Cpu(s):[m[39;49m[1m 0.8 [m[39;49mus,[m[39;49m[1m 0.0 [m[39;49msy,[m[39;49m[1m 0.0 [m[39;49mni,[m[39;49m[1m 92.0[m[39;49m[m[39;49m[K
KiB Mem :[m[39;49m[1m 32681700 [m[39;49mtotal,[m[39;49m[1m 18410244 [m[39;49mfree,[m[39;49m[m[39;49m[K
KiB Swap:[m[39;49m[1m 16449532 [m[39;49mtotal,[m[39;49m[1m 16449288 [m[39;49mfree,[m[39;49m[m[39;49m[K
[K
[7m PID USER PR NI VIRT RES [m[39;49m[K
[m 1 root 20 0 191072 3924 [m[39;49m[K
[m 2 root 20 0 0 0 [m[39;49m[K
[m 3 root 20 0 0 0 [m[39;49m[K
[m 5 root 0 -20 0 0 [m[39;49m[K
[m 7 root rt 0 0 0 [m[39;49m[K
[m 8 root 20 0 0 0 [m[39;49m[K
[m 9 root 20 0 0 0 [m[39;49m[K
[m 10 root rt 0 0 0 [m[39;49m[K
[m 11 root rt 0 0 0 [m[39;49m[K
[m 12 root rt 0 0 0 [m[39;49m[K
[m 13 root 20 0 0 0 [m[39;49m[K
[m 15 root 0 -20 0 0 [m[39;49m[K
[m 16 root rt 0 0 0 [m[39;49m[K[H[mtop - 21:17:29 up 31 days, 6:44, 1 use[m[39;49m[m[39;49m[K
%Cpu(s):[m[39;49m[1m 0.0 [m[39;49mus,[m[39;49m[1m 0.0 [m[39;49msy,[m[39;49m[1m 0.0 [m[39;49mni,[m[39;49m[1m100.0[m[39;49m[m[39;49m[K
KiB Mem :[m[39;49m[1m 32681700 [m[39;49mtotal,[m[39;49m[1m 18409876 [m[39;49mfree,[m[39;49m[m[39;49m[K
[K
Et tandem fasciculus incognitarum quaesitionum;
16:16:07.022910 () IP 059148253194.ctinets.com.58703 > 192.168.1.150.4244: Flags [S], seq 2829545743, win 1024, options [mss 536], length 0
16:15:57.133836 () IP 45.129.33.2.55914 > 192.168.1.150.39686: Flags [S], seq 700814637, win 1024, options [mss 536], length 0
16:15:56.603292 () IP 45.129.33.152.51777 > 192.168.1.150.jpegmpeg: Flags [S], seq 2349838714, win 1024, options [mss 536], length 0
16:16:15.083755 () IP 45.129.33.154.55846 > 192.168.1.150.7063: Flags [S], seq 4079154719, win 1024, options [mss 536], length 0
16:15:43.251305 () IP 192.168.1.150.60314 > one.one.one.one.domain: 3798+ PTR? 237.171.154.149.in-addr.arpa. (46)
16:16:24.386628 () IP 45.141.84.30.50763 > 192.168.1.150.12158: Flags [S], seq 572523718, win 1024, options [mss 536], length 0
16:16:44.817035 () IP 92.63.197.66.58219 > 192.168.1.150.15077: Flags [S], seq 4012437618, win 1024, options [mss 536], length 0
16:15:43.172042 () IP 45.129.33.46.51641 > 192.168.1.150.bnetgame: Flags [S], seq 362771723, win 1024, options [mss 536], length 0
16:17:02.120063 () IP 45.129.33.23.42275 > 192.168.1.150.11556: Flags [S], seq 3354007029, win 1024, options [mss 536], length 0
16:16:00.589816 () IP 45.129.33.3.56005 > 192.168.1.150.40688: Flags [S], seq 2710391040, win 1024, options [mss 536], length 0
Si has domains obstruo et IP inscriptiones in tabella exercitus, in altera TUBER eaedem litterae IP subnetae erunt, sed cum fine inscriptionum dissimilium, ac subdomains ditionum mutatione.
Mac non intellegit larvam in file hospitis *.example.com
Non figuravi quomodo videre facis quae transferuntur et quos processus vel daemones istas nexus faciunt (Mac paucos dies habui), sed iam est fun!
Source: www.habr.com