Siege Report — October 18, 2026

One hour on the Dojo’s WAN front, 07:00-08:01 on October 18, 2026, told minute by minute. The sniffer sits on the mirror, ahead of the firewall: it sees everything that knocks, including what will never get in.

An honest preamble. In this window the sniffer saw 1,727,165 packets reaching our public address. Most of it isn’t an attack: it’s the return traffic of normal browsing. The siege is the unsolicited slice, the part that knocks on the router and the firewall throws away — and here it is.

The play-by-play, minute by minute

07:00 — Window opens. The system is cold: CPU at 3.0%, memory stable at 1.591 MB. The gate is closed.

07:01 — First impact: 7.095 DNS packets dropped. The flow is constant; the rule blocks everything. Last Sunday, at the same time, it ran at about half this: the day starts heavier.

07:18 — Climbing to 8.402 hits. The target remains dhitc.com, ANY queries. No breach.

07:25 — 8.587 hits. Pressure builds, but the CPU doesn’t budge. Sources are spoofed: US, BN, GB leading the pack.

07:26 — 8.690 hits. Intermediate peak. Ports 8291 and 2000 remain silent: zero WinBox attempts, zero API calls.

07:36 — 8.335 hits. Suricata logs excessive handshake alerts, but no exploits. Just noise.

07:43 — 8.547 hits. Bandwidth test on port 2000 shows 1.819 hits, originating from TR and NL — Turkey again, same as last Sunday, with practically the same count (1,819 against 1,800). All dropped.

07:51 — Absolute peak: 9.699 hits in one minute. The system holds. Max CPU 6%. Nothing gets in, nothing gets out.

08:00 — Window closes. Total DNS dropped: 464.107. Other attempts: 2.915. Invalid: 574. PINGs accepted: 760.

08:01 — The gate remains closed. With low CPU, nothing entered or exited. Just the count of rejected hits.

Where they come from (with a pinch of salt)

Geolocation tells you where the address is registered, not where the person is: behind it there may be a VPN, an anonymizer, a rented server or someone else’s machine. And it has to be read per category.

• DNS amplification — the “sources” (US 225,115, BN 68,504, GB 67,679, HK 32,561, CA 25,103) are forged: they aren’t attacking, they’re the victims the attacker wants the replies rained on. Same as last Sunday, the Dojo would be used above all against the United States, but with almost five times the hits (225,115 against 47,000); Brunei (BN) is the big newcomer in second place, and Italy has dropped out of the top.
• Bandwidth test (port 2000) — 1,819 hits, from TR 1,796, NL 23.
• SYN scans — real source: BG 1,206, IT 1,091, US 196, UA 144, NL 92. Same as last Sunday, Bulgaria leads the scans with nearly the same numbers (1,206 against 1,234); Italy stays level, while the United States grows more timid (196 against 596).

The hour’s scoreboard

Suricata’s verdict

Suricata inspected the stream: 208 alerts, all of a single kind (“SURICATA STREAM 3way handshake excessive different SYNs”) — scan noise. No exploit, malware or intrusion signature: nothing hostile got in.

Compared to last Sunday

The report of Sunday, October 11 covered the same hour of siege, and the comparison helps read today. The volume grew: 1,727,165 packets against 829,000, with dropped DNS amplification queries rising from 128,622 to 464,107 — more than triple. Yet the CPU stays laughable: 3.0% on average against 1.8% then. The scans, by contrast, are nearly identical (about 2,900 in both windows), Bulgaria still in the lead; and the bandwidth test from Turkey is the same as seven days ago. What changes is who plays the victim of the amplification: the United States remains target number one, but with almost five times the hits (225,115 against 47,000), while Italy — second last week — drops out of the top spots and Brunei takes its place. Suricata closes as it did then: no intrusion.

And the machine?

Average CPU 3,0% (never above 6%). Free memory from 1,591 to 1,574 MB. Active connections between 141 and 243. No queue, no alarm.