Every router with a public address gets knocked on constantly, day and night, without anyone having picked it in particular. This page shows live what reaches the WAN of my lab: every arc is unsolicited traffic, drawn from the country the packet leaves from to the Dojo.
This is teaching material, not intelligence. Many of the attack maps you see around are stage scenery; here you get real traffic, classified in the lab, with its limits spelled out.
The country is where the packet comes from, not who is to blame. Behind an address there may be a rented server, a VPN or a compromised device; in DNS amplification the address is even forged and belongs to the victim. And no IP address ever appears on this page: neither the senders’ nor the Dojo’s.
I use it in my courses to show why a router’s firewall has to be written before you connect it to the Internet, not after.
The «Firewall OFF» button is a simulation: we never actually switch off the Dojo’s firewall. When you press it, the map takes the same real packets that are arriving and shows what would happen without filtering. For some attacks, the DNS amplification ones, you see the Dojo send back an answer tens of times bigger than the request, towards the victim whose address the attacker forged: those return arcs are simulated. Something very similar would happen if we really switched the firewall off.
The last hour in numbers Waiting for the first data…
What this map knows, and what it doesn't
It knows
- The country the packet originated from, according to an IP geolocation database.
- Which network operator (AS) announces that address on the Internet.
- When it arrived and what type of traffic it is, based on the protocol and port.
It does not know
- Who is behind it. The country is that of the sending machine: often a rented server, a VPN or a compromised device, not the person.
- If the address is genuine. With UDP it is spoofed: in DNS amplification, the country is that of the victim.
- The intentions. Many scans come from declared research projects.
- If an attack succeeded: here there is only traffic that reached the firewall.
No IP address: the page only receives country, category, operator name, time, and packet count. Neither the addresses of senders nor that of the Dojo ever leave the lab, and the destination point on the map is symbolic.
The categories
- Bandwidth test
- The MikroTik bandwidth test (port 2000): someone is trying to make the router generate traffic. A router with this service open becomes a free cannon.
- DNS amplification
- DNS responses that no one here requested. The source address is spoofed: the indicated country is that of the victim the attacker is impersonating, not the attacker's.
- Port scanning
- Probes to many ports to see what responds. Researchers, device search engines, and malicious actors do this: they cannot be distinguished from the packet.
- RDP
- Attempts towards Windows Remote Desktop (port 3389), which is not present on a router: whoever knocks is trying at random.
- Telnet
- Telnet (port 23): the preferred target of botnets of devices with factory default passwords.
- SSH
- SSH (port 22): brute-force attempts of usernames and passwords.
- PPTP
- PPTP (port 1723): old VPNs, targeted because they are often weak.
- SMB
- Windows file sharing (port 445): the port of major worms.
- SYN
- Half-open TCP connections: fast scans or saturation attempts.
To understand better
The Siege Report
It is an educational experiment: every Sunday I publish one hour of real traffic that reached the Dojo's WAN, with play-by-play commentary. Who knocks, where the packet comes from, what it is looking for and what the firewall does with it. Always aggregated data only, without a single IP address.
- 11 October 2026 Siege Report — October 11, 2026One hour of real WAN traffic at the Dojo's gateway, told minute by minute: 128,622 DNS amplification queries dropped, bandwidth-test probes from Turkey, scans from Bulgaria, and Suricata's verdict — no intrusion. All at 1.8% CPU.