lanrat

Something like this? https://reviver.com/

I observed very similar behavior a few years back when transferring files between two servers under my control on different parts of a large university network.

We also initially thought we were the subject of a breach, but after the investigation we determined that the network's IDS was monitoring all traffic, and upon certain triggers, would make identical requests from external networks.

We found a way to identify all other similar IDSs across the internet and even "weaponize" this behavior. We ended up writing a paper on it: https://ian.ucsd.edu/papers/cset2023_fireye.pdf

I made a open-wrt repo that auto-builds Tailscale for my older GL-Inet router for this exact use case: https://lanrat.github.io/openwrt-tailscale-repo/

Hi everyone,

This is actually my project that I started years ago to track changes in root zones files. Let me know if you have any questions.