Hot answers tagged

423

EDIT 2: there is one good reason why this post is attracting so much attention: you managed to record the whole, live session of an intruder on your PC. This is very different from our everyday experience, where we deal with the discovery of the consequences of his actions and try to redress them. Here we see him at work, see him having some problems with ...


368

As you can see from the output, you aren’t actually pinging some server in Arizona or even the United States. Apparently, they decided to protect their website with Cloudflare, which employs a content distribution network to even the load. A CDN works with many nodes, each servicing a (geographic) region. That means the node you’re pinging is very close to ...


197

Sam3000's answer is very nice. I'll add some technical details. Wake on Magic Packet causes the network card to awaken the computer when it receives a magic packet. A packet is considered "magic" when it contains FF FF FF FF FF FF (six instances of the largest possible byte value) followed by sixteen instances of the card's six-byte MAC address. That ...


127

Welcome to the Internet - where any open SSH server is likely going to get probed, brute-forced, and have various indignities inflicted upon it. To start, you need to completely wipe the storage on the product. Image it if you want to pass it on for forensics, but the Linux install on it is now suspect. Bit of guesswork but You got brute-forced or use a ...


114

What's the difference between 127.0.0.1 and 0.0.0.0? 127.0.0.1 is the loopback address (also known as localhost). 0.0.0.0 is a non-routable meta-address used to designate an invalid, unknown or non applicable target (a no particular address placeholder). In the context of a route entry, it usually means the default route. In the context of ...


112

These two settings form a feature of most modern computers known as "Wake on LAN"; in a nutshell, leaving this setting on allows the network card of your system to receive sufficient power to remain in standby mode, while the rest of the system is powered off. While in standby mode, it may receive a "magic packet" - a small amount of data specific to the mac ...


95

They are not the same. 127.0.0.1 is part of the 127/8 network which is reserved and points to the same computer. 0.0.0.0 is a special IP address that means different things depending on context. In the Internet Protocol Version 4, the address 0.0.0.0 is a non-routable meta-address used to designate an invalid, unknown or non-applicable target. To ...


85

To answer your question of how it knows, it has to do with what your browser sends the server. You're right that the system always resolves it to an IP address, but the browser sends the URL you attempted to access in the HTTP header. Here is a sample header that I found online, modified to look as though you used Firefox on Windows and typed apple.com ...


82

The Internet is a system of interconnected smaller networks that can reach each other through routing. You could essentially "follow the path" to any server you're directed to, but there are basically endless paths to any destination. If you were to start from your Ethernet connection, you would first hit your home router, then hit your ISP's routers. The ...


79

I think generally routers serve as an access point, DHCP, firewall and switch as an easy solution for people who don't know much about networking No, routers are a separate kind of device from APs and switches. "Router" is not just a generic name – it describes a specific function, routing IP packets between networks. In other words, you're ...


77

Does this mean that the bandwidth is 6Gb/s but the actual throughput is 4.8Gb/s ? Yes it does. It is interesting to understand why. While data is actually sent at 6Gb/s, it is encoded to counteract two common defects in telecommunications, DC bias and Clock Recovery. This is often accomplished using a specific coding algorithm called 8b/10b encoding. ...


70

Routers aren't necessary unless your traffic needs to move to a different subnet. When a computer wants to send some IP traffic to a different machine on its subnet, it needs the recipient's MAC address, since IP addresses aren't a thing at a switch's layer (Layer 2 of the OSI model). If it doesn't know the MAC address, it broadcasts an ARP request, saying ...


67

The Internet Assigned Numbers Authority (IANA) is a department of ICANN, a nonprofit private American corporation that oversees global IP address allocation, Domain Name System (DNS), well-known ports and other Internet Protocol-related symbols and numbers. On March 1990 they published the document RFC1060 where they listed the well-known ports at that ...


66

The Internet of Things does not absolutely mandate IPv6, but for IoT to be useful or usable IPv6 is very much preferred. IPv4, due to the limited number of addresses available means that not every device can have a public IP. For a cluster of devices to share an Internet connection then they have to share the IP via NAT technologies. If the devices want to ...


63

It's useful to understand what a splitter does. It turns one 8-strand ethernet cable into a what would be, essentially, a pair of sub-standard 4-strand cables that in theory should do Fast Ethernet (100BaseT/TX). Practically this might drop down to 10BaseT speeds, and you need to use a splitter on both ends for it to work. It will take up two ethernet ports ...


62

Definition of a cross over cable: A cross over cable is typically used between devices with the same type of interface (ie computer to computer, router to router, etc). Ethernet cables are usually made as an A or B type interface (which matters simply how it is wired. A crossover simply has A on one end and B on the other. What is happening: ...


60

Please be aware that a system can handle more than 65536 concurrent connections, because they do not necessarily each use a separate port. A TCP connection or UDP flow is defined by the 4-tuple: (source IP address, source port, destination IP address, destination port) So even if you have a web server machine with just a single IP address, and a single ...


56

Each connection to a website uses a different socket with default destination TCP port 80 for plain HTTP and 443 for HTTPS. For the socket to be unique, the combination of the source IP address, source TCP port, destination IP address and destination TCP port must be different. If you have multiple connections to the same website (assuming the website uses ...


53

Why does Qatar use a single IP address when it was given more than 800000 IPs by IANA? At first glance, this doesn't seem to be true – according to WHOIS, 82.148.97.69 is part of a larger "Mobile-Broadband-Pool-No-6" having ~90 addresses. So maybe it's only a slight exaggeration – many mobile ISPs in other countries also put thousands of customers ...


46

The short answer - Yes. It usually works by default. The long answer - Depending on what you are using it for, it may slow down with multiple connections, but that is a bandwidth issue, not an ssh issue.


45

Answer to the question subject: it doesn't. There are multiple ips in active use, and even the top ones have <200 current users. However, Is it conceivable that back in 2009 everyone in Qatar had the same public IP address? I think it is, at least if by "2009" you mean "back in the time of Wikipedia blockade in the news". The wikipedia blockade ...


42

By definition on a layered model as OSI or TCP/IP each layer works independent and not-aware of the lower layers. When you remove the cable, it's a physical disruption (layer 1), so almost inmediately ethernet (layer 2) detects a loss of signal (if you're on Windows you will see the very dreaded pop-up informing network disconnected) IP (layer 3) and TCP ...


41

This is a good example of when superuser tries too hard -_-; The answer is simply yes. Yes, you could follow cables from your computer all the way to the ESPN server, following the same path as a HTTP GET packet would take. You would probably have to go underwater at some point depending on your location, and almost certainly have to break in to a ...


40

In short: for BitTorrent (p2p) protocol to work at least one peer has to have a publicly open port (be an active node). You can run Transmission without port forwarding (stay a passive node) and you will connect, download and seed files with no problems. However your client would only be able to communicate with active nodes. With port forwarding enabled ...


37

Do browsers use different ports to connect to different websites? Yes, they do. Here is an example, showing my current Firefox connections (I have 9 open tabs) on Windows 7: Notes: You can see that the local ports are all different. The remote ports are usually 80 (HTTP), 443 (HTTPS) or 8080 (HTTP Alternate). Many other ports are used to host web ...


35

No, they're just getting the radio waves out of the air. As long as they're not sending anything, you can't tell that they're receiving. (It's like how FM radio stations can't tell who or how many people are listening.) I have heard that some wireless access points can direct the radio signals to the appropriate clients, which is pretty neat, but you ...


31

Oh, you have been definitely hacked. Someone appears to have been able to gain root credentials and attempted to download a Trojan to your system. MariusMatutiae provided an analysis of the payload. Two questions arise: a) Was the attacker successful? And b) what can you do about it? The answer to the first question may be a no. Notice how the attacker ...


29

Firstly, what is the purpose of me being assigned one of each type? Ideally, we should be moving towards greater IPv6 rollout, due to IPv4 exhaustion. However, a lot of servers still don't support IPv6 - there are many workarounds, none particularly great, but they generally involve tunneling through an intermediate server that can translate between the ...


27

Yes, and they don't need any magic here, just trivial matching on the TCP packet contents. Even though SSH and TLS (SSL) encrypt their payloads, the protocol headers themselves are still distinguishable and very different from each other. For example, a SSHv2 connection always starts with the client sending SSH-2.0-(client name and version). Similarly, even ...


26

Yes, most likely it was hacked. The tell-tale sign is the range of ports used: all OSes use low ports ( < about 10,000) to listen for incoming connections, and high ports (the remaining ones, but especially those above 30,000) for outgoing connections. Instead, your log displays connections between pairs of high ports, which means no conventional access ...



Only top voted, non community-wiki answers of a minimum length are eligible