This just sounds like normal monitoring to me, so yeah it makes sense. You can use things like prometheus (free/open source) to do this (with an exporter). https://github.com/czerwonk/ping_exporter Prometheus can keep a time series history and alert on the results (if they degrade). Alerts can be sent to things like slack or pager-duty (so you can get a phone call or message immediately if it stops working). Lots of paid services exist for this too obviously.

There may be other ways to achieve this. But the most elegant way we found was using python's socket library. You can get all the info in a one liner, and extract it into a list in another line. It's fast, short, readable, and easy to put in a loop against a ton of records. The Code import socket net_info = socket.getaddrinfo("stackoverflow.com", None) ip_list = set([x[0] for x in [x[4] for x in net_info]]) print(ip_list) Output {'151.101.129.69', '151.101.1.69', '151.101.193.69', '151.101.65.69'}

It looks like you could use a dip into the Risk pool. Things are just things until they present a hazard. Whether or not they present a hazard depends on its context. Nothing is inherently a hazard. If an IP being known represents a typical hazard will depend on a few factors. It is not a typical hazard across multiple contexts (IPs tend to be public knowledge for public portals). You then have to separate the idea that the hazard might have mitigations (like CloudFlare). Leave the mitigations aside when considering whether something is a hazard. And then you should not focus on common hazards for all Internet users (like DDoS). Those hazards are "boilerplate" that would apply to everyone. It's like saying, "the Internet could stop working". While true, it's not a specific threat to them (unless you can show that it is a unique threat in their context). When writing a report on the specific hazards that a specific target might experience, you want to focus on the unique hazards that exist for them and their context. Everyone knows they could get a DDoS. However, they might have thought that an IP was hidden or not associated with them, but you found the connection. But that's only a hazard if you know (or can guess) that the target hoped to keep that info hidden. Or you might be able to show that the target is uniquely vulnerable to a DDoS or being targetted for one.

There are lots of reasons for this: a misconfigured client that is sending traffic to your site meant for something else a mapping technique to try to find 'hidden' or non-obvious resources on your site sending known exploit strings to your server to see if your server has a vulnerability

Google Meet is an application based on WebRTC technology stack. Instead of relaying the video through a central server, all members connect to each other and peer to peer share their information. Joining a google meet causes your browser to talk with STUN servers to see their IP and those are send to the Google Meet servers to be send to other participants. You receive the ip's of the others. Most browsers also share their LAN ip addresses if video/microphone access is granted before joining, which helps improve the speed if both people are in the same network. You can use browser dev tools to see the IP address, or just look at a network monitor tool to see which IP your PC talks to.

The answer is quite un-exciting: they didn't need to do anything. You are talking about a time when there were not a lot of cyber laws and fewer people who could understand or enforce them. So law enforcement only spent their resources on the big crimes. So, if someone wanted to commit a big crime, they would do what you mention: take over a smaller company/service, wipe the logs (no one would notice), then use that as a launchpad. If they were discovered on the smaller location, they would not have committed a crime big enough to warrant investigation. So, they could do it over and over again as much as they needed to. No need to get fancy with your "detection evasion techniques" when there is no one watching.

You can check the https://www.gstatic.com/ipranges/goog.json that Google advertises to the internet. The list does include 209.85.128.0/17 which corresponds to all addresses between 209.85.128.0 and 209.85.255.255. So yes, the IPs you list do belong to Google. Do note that simply checking if the IP belongs to Google using a IP whois lookup is not enough, as that would include IPs from Google Cloud, which can be used by customers and may potentially even be malicious.

You don't explicitly say so, but I assume you're not going to sign in with your old account from B, and that you'll use a new email address, etc. when you create a new account. Short of compromising the ISP, or you copying data (e.g. transferring cookies) from A to B, not reliably. IP addresses are given out over moderately large geographic areas (ever seen a GeoIP service think you're a couple cities over from where you are? That's the level of resolution they have) and all IPs within that pool are interchangeable as far as an outsider is concerned. It might be able to guess based on any number of signals (e.g. if you use the same browser on the same OS with the same extensions installed on both A and B, browser fingerprinting can do a surprisingly decent job of matching and if there's not a lot of people running that particular configuration it might be literally unique on that site to just your two machines) but it wouldn't be possible for the site to confidently assert that it's the same user.

You are not checking the users IP address in most cases here: my public address (VPN) is the IP address of the VPN endpoint. While it is unique on the internet it is shared with many other users using the same VPN. my VPN address in my network settings is the IP address of your machine in your local network. Usually this is an IP address in the https://en.wikipedia.org/wiki/Private_network range. It is not routable on the internet, not unique and is associated with different systems in different LAN. My private address is the IP address of your router or in case of CG-NAT some router in the infrastructure of your ISP. It is thus shared with other systems in your LAN or even with other users of the ISP. users IP with middleware on Parse Back4App looks like some IP address of an internal infrastructure, similar to your IP address in your local LAN. It is thus shared too. None of these IP address can be used to uniquely identify a user. Some are internal IP only and can not be used at all, others usually represent multiple machines. Apart from that the VPN exit and the IP allocated by the ISP are often dynamic, i.e. they can change over time. Which means relying on the IP address to identify a specific user on the internet is not a good idea in the first place. Any rate limiting or black listing will only work for a short term and can often be easily explicitly bypassed by reconnecting to the ISP or by using a different VPN endpoint. Additionally there is a risk of overblocking, i.e. of blocking other users behind the same IP address. As long as one is aware of these limitations it might be used as a short term mitigation against attacks, but not as a reliable long term prevention method.

It depends upon what sort of payload you're deploying. For example, a reverse TCP payload would trigger the target to make an outbound connection to the attacking IP address you've specified, and so would not be vulnerable to someone else trying to take advantage of it. On the other hand, a TCP listener on the target might accept connections from any IP address, and therefore be vulnerable to anyone who happened to scan your target at the right time.

Your points are true in certain situations, but not all traffic would only be one way For TCP, the handshake would not complete, so there would be one packet, not all traffic. UDP has the a similar problem. The sender would be sending blind traffic, but all of it disconnected and no coherent response from the receiver. That's going to severely limit what "nefarious things" can be done. Mostly, it leaves only network-level nefariousness, like DDoS, flooding, etc. the ISP/local router would immediately detect it and flag it It would depend on what monitoring is in place and what IP was being spoofed. There are ways to detect that an IP is coming from a strange network or interface. If that is turned on, then certain IPs would be detected. The common cases are if an IP associated with one network interface enters from another, or if private network IPs are coming in from the public network interfaces.

No, people will get the IP address of Instagram servers, not your device. But... if the recipient sends you a message with a link, and you click the link, you can be tracked because it's your device that will access the link. If you use a VPN, the IP on the logs are the IP of the VPN servers, not yours. So even clicking the link would not easily reveal your IP.

In the vast majority of cases, no. Lots of sites will use CDNs and other mechanisms that mean they may have multiple IP addresses, so whitelisting them all will be impractical. You may also have multiple sites hosted on the same IP address - so if you whitelist that IP then you allow access to all of them (which may not be intended). Finally, there is no guarantee that IP addresses will remain the same - so if you whitelist based on them then at some point they will change and your system will break.

The approach is wrong. The whole point of DNS is that the domain name is what identifies the site or service, and the underlying IP addresses are abstracted away and subject to change. A service is not guaranteed to be uniquely associated with one IP address, nor is an IP address guaranteed to be uniquely associated with one service. Even if you do manage to find such an association, that may change at any point and break your processes. If the organisation's security policy is to block GitHub for general users, in order to mitigate access to publicly hosted exploit scripts and make accidental publishing of internal code more difficult, that's fine. But security policies should be contextual, taking into account the business requirements of the people and processes that those policies apply to. Security is a service that should aid people in completing their work in a secure manner. If you have a requirement that a security control impedes, here are the steps you take: Investigate whether there is an alternative approach that satisfies that requirement without modifying the existing security policy. If no alternative can be found, investigate ways in which the security policy can be relaxed or removed with the minimal possible scope and impact. Assess whether the changes require further security mitigations to be put in place, and implement those mitigations. At each point, you should consider both the reason for the requirement and the reason the security policy was put in place. For step one, let's look at what you're doing right now: My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github. Assuming that all of the Ubuntu VMs share an internal network, a potential alternative to using GitHub would be to have your own git server running internally, and configure it as a mirror for the GitHub repository. A firewall exception would only have to be added for that specific server. If that isn't feasible, e.g. because the VMs don't share private network access, you're onto step 2. Why was the security policy to block GitHub put in place? Maybe it's to limit a potential attacker's access to exploit scripts, or prevent malware from grabbing C2 config / malicious files from raw GitHub content. Maybe it's to prevent accidental upload of internal code. In both cases there's a fairly easy solution: implement a separate security policy specifically for the affected hosts. The firewall should allow access to TCP port 22 on github.com (i.e. allow outbound TCP SYN, and inbound packets related to existing connections) so that SSH-based GitHub access can be used as the remote for the repo. You can automate rule configuration using the https://api.github.com/meta , which lists the IP relevant addresses under the git JSON property. Finally, you're onto step 3. Are there mitigations you could put in place to help bolster security, given the policy changes? If you've set up an internal git server, you might implement additional security procedures and policies, such as only syncing the mirror when a manual process is completed. You could require authentication to read repos from the git server, and pin HTTPS certificates or SSH server keys on the Ubuntu systems. If you're not deploying an internal git server, but instead are unblocking SSH to GitHub on the VMs, you could enable strict host checking and add the GitHub SSH fingerprints to the servers' known SSH hosts list. You should repeat this set of questions for the LFS part of your requirements, since there may be differences in the requirements, or certain servers may not need access to LFS.

To this end, the site should have a dedicated IP. Like VPS or dedicated. It's not gonna work out on regular shared-hosting, there's hundreds of sites on one IP.

Where you've read it. Don't read such resources again... Better get a literate book on networking.NAT is not a web filter, it's an address substitution system. If the NAT provider doesn't have enough reals. And if that's the case, whatever technology you're sending a package to such a ip provider won't know which one of the customers will transfer it. For any NAT is based on a memorial to the sessions established. Here you are sending a bag to port 443 from your own. Internal ip, we're still silent on port 12345. The provider changes your IP to some of his pool and changes the port of sender to 32,000, and remembers that any packages coming to port 32,000 of the goul (from where the ip was sent) should be sent to X's client to port 12345. If a package comes outside to any other port for which such a condition has not been remembered, the package will be destroyed because it will not be clear to whom to send it.Any small literate online filter provider is blocked first. any packages coming from subscribers any coming from the IP, which was not issued to the subscriber. So the IP replacement package will be killed on the first route (and in some cases directly on the scroll where the subscriber is included). In addition, silence was killed, without the formation of ICMP. There are no such blocks on interoperative channels (and not always).The notion of keep-alive exists only for protocols with a connection established. There are no packages for ICMP. ICMP is not physically capable of stopping the way. Except where this ICMP is a request for ping and falls within the overall NAT scheme.

♪ /etc/network/interfaces Write.auto eth0 allow-hotplug eth0 iface eth0 inet static address 192.168.1.2 netmask 255.255.255.0 gateway 192.168.1.1 auto eth0:0 allow-hotplug eth0:0 iface eth0:0 inet static address 192.168.1.3 netmask 255.255.255.0 auto eth0:1 allow-hotplug eth0:1 iface eth0:1 inet static address 192.168.1.4 netmask 255.255.255.0 IP addresses are naturally mine, and then DNS and routing.

Inscribe in the IP database and indicate the time of access текущее время + 10800♪ And in the right file, check if this IP is available (and if more time is specified in the machine than current, if so, open up).

The question makes no sense that it's not working.== sync, corrected by elderman ==Update after codeYour mistakes are here.servlen = sizeof(tmp_addr); // видим struct sockaddr *tmp_addr и похоже это не тот размер -) if(getsockname(sockfd, &sa, &servlen) == -1){ error("ERROR on getsockname"); } tmp_addr_in = (sockaddr_in*)tmp_addr; // этот указатель Watching where.inet_ntop(AF_INET, &(tmp_addr_in->sin_addr), // вот тут Вам не повезло, прога НЕ УПАЛА (а то, сами бы в отладчике нашли) bufServerIp, INET_ADDRSTRLEN); And they're all connected. tmp_addr_in and tmp_addr♪I guess we should just write.servlen = sizeof(sa); if(getsockname(sockfd, &sa, &servlen) == -1){ error("ERROR on getsockname"); } inet_ntop(AF_INET, &((struct sockaddr_in *)&sa)->sin_addr, // видимо тут-то Вы и запутались bufServerIp, INET_ADDRSTRLEN); == sync, corrected by elderman ==I'll risk assuming the variable clilen not initiated before the challenge accept()♪ B http://man7.org/linux/man-pages/man2/accept.2.html It says: The addrlen argument is a value-result argument: the caller must ini‐ tialize it to contain the size (in bytes) of the structure pointed to by addr; on return it will contain the actual size of the peer address. So write:socklen_t clilen = (typeof(clilen))sizeof(cli_addr); to call accept() (which may change its meaning).Besides, with "finished" socket, it doesn't matter to the client or server, it's always possible to find out as your own address (IP, port)int getsockname(int sockfd, struct sockaddr *addr, socklen_t *addrlen); And the "vizavi" address.int getpeername(int sockfd, struct sockaddr *addr, socklen_t *addrlen); In both cases the parameter addrlen the challenge must be initialized (a logical example, with the accept()() The size of the buffer for the address indicated *addr♪This is an example:avp@wubu:hashcode$ cat serv-ips.c #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> #include <unistd.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <netdb.h> #include <arpa/inet.h> #define errExit(msg) do { perror(msg); exit(EXIT_FAILURE); } while (0) static int makeSimpleServer (char *cport) // default port = 12345 { int on = 1, asock = socket (AF_INET, SOCK_STREAM, 0); if (setsockopt(asock, SOL_SOCKET, SO_REUSEADDR, (char *)&on, sizeof (on)) < 0) errExit("socket"); short port = cport? atoi(cport): 12345; if (port < 1) port = 12345; struct sockaddr_in addr; int laddr = sizeof(addr); memset (&addr, 0, laddr); addr.sin_family = AF_INET; addr.sin_port = htons(port); addr.sin_addr.s_addr = INADDR_ANY; if (bind(asock, (struct sockaddr *)&addr, laddr)) errExit("bind"); struct linger ling; ling.l_onoff = 1; ling.l_linger = 2; // seconds after shudown sock for deliver data if (setsockopt(asock, SOL_SOCKET, SO_LINGER, (char *)&ling, sizeof(ling))) errExit("linger"); if (listen(asock, 128)) errExit("listen"); return asock; } int main (int ac, char *av[]) { // port av[1] (default 12345) and INADDR_ANY int asock = makeSimpleServer(av[1]); int sock; struct sockaddr inadr; socklen_t slen = sizeof(inadr); while ((sock = accept(asock, &inadr, &slen)) > 0) { printf ("New connection %s:%d\n", inet_ntoa(((struct sockaddr_in *)&inadr)->sin_addr), ntohs(((struct sockaddr_in *)&inadr)->sin_port)); if (getpeername(sock, &inadr, &slen) == -1) perror("getpeername"); else printf("getpeername %s:%d\n", inet_ntoa(((struct sockaddr_in *)&inadr)->sin_addr), ntohs(((struct sockaddr_in *)&inadr)->sin_port)); if (getsockname(sock, &inadr, &slen) == -1) perror("getsockname"); else printf("getsockname %s:%d\n", inet_ntoa(((struct sockaddr_in *)&inadr)->sin_addr), ntohs(((struct sockaddr_in *)&inadr)->sin_port)); close(sock); errno = 0; } perror("server exit"); } avp@wubu:hashcode$ gcc serv-ips.c && ./a.out New connection 10.3.35.78:46980 getpeername 10.3.35.78:46980 getsockname 10.3.35.78:12345 New connection 127.0.0.1:50958 getpeername 127.0.0.1:50958 getsockname 127.0.0.1:12345 ^C avp@wubu:hashcode$ In another window, I started, respectively.avp@wubu:~$ nc 10.3.35.78 12345 avp@wubu:~$ nc localhost 12345 As you can see, I'm working.UpdateI thought you had a challenge problem. inet_ntop()♪ ♪ ♪In accordance with http://man7.org/linux/man-pages/man3/inet_ntop.3.html The resulting string is copied to the buffer pointed to by dst, which must be a non-null pointer. The caller specifies the number of bytes available in this buffer in the argument size. ♪ ♪ ♪ ♪ AF_INET src points to a struct in_addr (in network byte order) which is converted to an IPv4 network address in the dotted-decimal format, "ddd.ddd.ddd.ddd". The buffer dst must be at least INET_ADDRSTRLEN bytes long. The example code should include:char buf[64]; inet_ntop(AF_INET, &((struct sockaddr_in *)&inadr)->sin_addr, buf, sizeof(buf) - 1) I checked, the results are exactly the same as the call. inet_ntoa(...)

Just some Johnny Direa of Hamburg, the owner of this domin, wanted a symbolic name to be consistent with address 127.0.0.1, which is amazing? You can ask him why he did it, for example, on e-mail'u: pedalisimo@yahoo.com