Re: can't replicate/block portscanner

2016-12-09 Thread Jonathan Vanasco
On Dec 9, 2016, at 7:09 PM, Robert Paprocki wrote: > Should be fairly easy to do with any command to write data over the wire > (nc/netcat/echo into /dev/tcp): Thanks for all this... I now mostly understand what was going on. The *intent* of the nginx setup was do to the following, via 3 serv

Re: can't replicate/block portscanner

2016-12-09 Thread Robert Paprocki
Should be fairly easy to do with any command to write data over the wire (nc/netcat/echo into /dev/tcp): echo -en 'GET / HTTP/1.0' | nc 1.2.3.4 It should be worth noting that the Host header is not a required HTTP/1.0 header, so if your app requires the Host header (or derives some other variable

can't replicate/block portscanner

2016-12-09 Thread Jonathan Vanasco
I got hit with a portscanner a few minutes ago, which caused an edge-case I can't repeat. the access log looks like this: 94.102.48.193 - [09/Dec/2016:22:15:03 +][_] 500 "GET / HTTP/1.0" 10299 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" "-" cookies="-" the se