Friday, December 31, 2010


This is kind of interesting.

Being on the private network and all, I can't see the main stream of internet traffic - or, I don't know how to watch it from an external host, same thing. Anyways, I am reduced to watching Sitemeter to see if anything interesting pops up there. So we get the Italia thing from last time.

Sitemeter tells me the referring URL for most visitors to this site. 98% of them are referred from Google, because they've searched for MS-WBT-SERVER and that April page is the top return for that search. The ones that aren't from there are the interesting ones. Today I get the following referral:

An IP address starting with 10.* is a private network address - so at first I thought this was a referral from some site on my own network, which doesn't make any sense at all. Then, slightly more sensibly, I thought it must be a reference from within the Blogspot network. Then I gave up guessing, and Googled it.

A number of forum questions suggest that someone on a private network tried to see this site, but it (i.e. was blocked by WebSense software. So WebSense poked the site, found it was on its block list, and probably gave that person a notification that it was blocked - 15871 is the port used by the WebSense monitor or something, so this actually reveals (I think) the user's own IP address. The request came from an address in Tamil Nadu, India.

So, strangely enough, this is a way of getting information about a user from within a private network - get your site blocked by them, then you can see their external, public address when they attempt to connect, and their private address when WebSense bounces them off. Neat!


The public address sitemeter gave me was 203.99.193.* - this is registered to Cognizant Technology Solutions - long story short, Cognizant is (among other things) an outsourcing company. No way of knowing exactly what they're doing there, some sort of white collar stuff, call centers, that sort of thing.

No comments:

Post a Comment