Internet

My TFTP honey pot has been running for over a month, continuously on my $5 a month VPS, and intermittently on my Dell R530 home server. It’s time to see what surprises it has captured.

One of my blog posts, the one about .git crawlers, got posted to Lobste.rs, a computers and computer science oriented link aggregator, and to Hacker News, a startup, venture capital ideology and occasional science/math link aggregator.

I’ve had another post make it to all three of Hacker News, Slashdot and Lobste.rs before, but on that occasion I compared Hacker News to Slashdot humans. Here, I compare Hacker News to Lobste.rs humans.

I found a small series of odd HTTP requests from IPv4 address 104.244.79.113 while I was looking at Apache web server log files.

Because of the simplicity of TFTP, and the difficulty I had using existing TFTP servers, I decided to write a honey pot TFTP server. This seemed like an easy, no consequences, way to try out my honey pot design principles.

I’ve run various honeypots for a long time. I ran a WordPress honeypot off and on from 2013 to 2018. I’ve run endlessh on my home server for years. Before that, I ran the cowrie ssh/telnet honey pot for a while.

Currently, this website runs a fake WordPress login that tells you that you’ve used the wrong password after a 5 second delay. Feel free to try it. This website’s contact page does nothing but wastes spammers time and effort.

While fiddling with my educational TFTP client code I noticed an oddity. Sometimes my client could talk to a TFTP server, but not vice versa. The TFTP server, when it condescended to acknowledge a connection, logged a message like recvmsg(): connection refused. I used a local TFTP server, running on my laptop, to avoid these errors, but the mystery of why the server returned no TFTP ACKs or DATA packets remained.

My laptop’s /etc/hosts file has entries like this:

fe80::46a8:42ff:fe2d:c255 monarcheno1
# eno2 - 10.0.10.1
fe80::46a8:42ff:fe2d:c256 monarcheno2
# eno4 10.0.20.1
fe80::46a8:42ff:fe2d:c258 monarcheno4
# ens5 10.0.40.1
fe80::6a05:caff:fe4a:8ac7 monarchens5

IPv4 address 35.211.226.190 requested the URL /posts/dfuds/ from my blog’s web server 841 times between 2026-01-16 and 2026-03-10, approximately once every 45 minutes.

I bought a 8-port Netgear GS308E switch. I plugged it in, and it worked, but I noticed the LEDs on the RJ-11 ethernet socket flickered regularly.

At 2025-11-15T15:38:20Z, I submitted my Goofing on Meta blog post to the Hacker News link aggregation website. Shortly after that, at 2025-11-15T18:22:00Z, short blurb tech news website slashdot.org put an article about the same blog past in the Technology News section.

Since I run my own web server, I can see how the two sites’ users compare.