This forum post talks about monitoring outgoing SPHERE traffic to catch accidental scans and attacks. It primarily focuses on DDoS and scanning and low-hanging fruit where it is easy to detect misbehavior. With use of AI agents on the testbed these rules ensure we don’t accidentally let bad stuff into the Internet.
There are two things to track:
-
how many different dest IPs an experiment node contacts (I suggest limit of 10 per second and maybe 50 per minute, but if you run counters first without blocking and log them we can learn what normal pattern is. So we don’t guess at these numbers)
-
percent unsuccessful connections (usually this means outgoing packet without return packet, I suggest having a rule like - more than 10 were observed AND more than 10% failure)
We should also get alerts on MM when someone is blocked and we should log them somewhere too, in a format that we can query. An alert should say “realization a.b.c blocked machine client on epoch-time due rule (1 or 2)” and then some measurement of the violation like for rule 1 it would be “contacted 30 destinations per second”
I would also like to save tcpip headers of outgoing and incoming traffic, at least for a day