Honeypots mailing list archives

Re: Simulating web traffic


From: PCSage Information Services <info () pcsage biz>
Date: Wed, 16 Jun 2004 15:50:54 -0400

Would it not make sense to use valid logs to simulate user activity?? i.e. have a perl script parse some old logs (perhaps a database of logs so that they can be refreshed periodically so as to not look manufactured) and use these old logs to mimic the traffic already received? you can have the script use 3rd party proxy servers ( i.e. anonymizer ) to simulate the connections coming externally. Worthy of investigation me thinks...

Sean Swayze
swayze AT pcsage DOT biz

On 16-Jun-04, at 1:11 PM, Valdis.Kletnieks () vt edu wrote:

On Wed, 16 Jun 2004 15:37:44 +0200, Lorenzo Hernandez Garcia-Hierro said:

The best way to do what you wanted,in my opinion, is running a web
spider as a cron job or from the rc of each system user of the rest of
connected machines  ( when the user logs in the spider is executed and
the time will not appear to be a strictly timed job).

Note that without *heavy* modification, it will probably be quite easy to distinguish a spider from a "real" user. Most spiders will stay connected for a long time, and end up visiting all the linked pages eventually. On the other hand, users will come in - as many as 80% will probably already have a page bookmarked to go to, and the others will hit the home page, and then the vast
majority will go to your "most popular" links.

Looked at differently - if it's been at your site for 3 hours and is now looking at your press releases from 1998, it's either a spider, somebody conducting an info-gathering mission preparatory to industrial espionage or
legal action, or somebody severely in need of a life.... ;)




Current thread: