Honeypots mailing list archives

Re: Simulating web traffic


From: Valdis.Kletnieks () vt edu
Date: Wed, 16 Jun 2004 13:11:00 -0400

On Wed, 16 Jun 2004 15:37:44 +0200, Lorenzo Hernandez Garcia-Hierro said:

The best way to do what you wanted,in my opinion, is running a web
spider as a cron job or from the rc of each system user of the rest of
connected machines  ( when the user logs in the spider is executed and
the time will not appear to be a strictly timed job).

Note that without *heavy* modification, it will probably be quite easy to
distinguish a spider from a "real" user.  Most spiders will stay connected for
a long time, and end up visiting all the linked pages eventually.  On the other
hand, users will come in - as many as 80% will probably already have a page
bookmarked to go to, and the others will hit the home page, and then the vast
majority will go to your "most popular" links.

Looked at differently - if it's been at your site for 3 hours and is now
looking at your press releases from 1998, it's either a spider, somebody
conducting an info-gathering mission preparatory to industrial espionage or
legal action, or somebody severely in need of a life.... ;)


Attachment: _bin
Description:


Current thread: