Siege Report — October 11, 2026

One morning hour on the Dojo’s WAN front, told minute by minute. The sniffer sits on the line’s mirror, ahead of the firewall: it sees everything that knocks, including what will never get in. The gateway has its rules up, Suricata is listening.

An honest preamble. On the mirror, in one hour, about 829,000 packets reach our public address. Most of it isn’t an attack: it’s the return traffic of the Dojo’s normal browsing — the replies from Meta, Cloudflare and Google to our own devices behind the NAT. The siege is the unsolicited slice, the part that knocks on the router and that the firewall throws away. That part the router itself measures, and here it is.

The play-by-play, minute by minute

08:08 — We’re off. Mirror on, firewall up, Suricata listening.

08:09 — A flying start: 3,432 hits in the first minute. All aimed at the resolver, all dropped. The scan floor never drops below ~40 a minute: the metronome.

08:11 — First lull, 1,770. Meanwhile, on port 2000, the bandwidth test knocks: 1,800 hits over the hour — and, a curiosity — all of them from Turkey.

08:15–08:17 — Second wave, 3,018 then 3,116: ANY queries for dhitc.com, the request that inflates the reply the most.

08:20–08:30 — Holding, between 1,500 and 2,800. Connections around 160-200, CPU 1-2%. The SYN scans probing the ports come mostly from Bulgaria, then Italy and the United States.

08:32 — It speeds up: 3,299.

08:33 — The morning’s peak: 3,982 hits in one minute. Almost 66 a second against the DNS rule, and down they go. The machine? CPU 2%.

08:34–08:35 — It eases: 2,788, then 2,066.

08:42–08:48 — A long plateau: seven minutes above 2,500, peaking at 2,856 (08:43). The fullest stretch of the hour: steady pressure, nothing getting through.

08:55 — The CPU’s only twitch to 4%: 2,549 hits with a little real outbound traffic mixed in. It lasts a minute.

09:00–09:01 — Peak of active connections: 243. The Dojo’s real traffic mixes with the noise; the hits fall to ~1,500.

09:05–09:08 — A downhill finish: 1,599, 1,505, 1,345 (the quietest minute), 1,643.

09:09 — Final whistle.

Where they come from (with a pinch of salt)

Geolocation tells you where the address is registered, not where the person is: behind it there may be a VPN, an anonymizer, a rented server or someone else’s machine. And it has to be read per category, because they are not the same thing.

• DNS amplification — the “sources” (USA 47,000, Italy 26,000, Mexico 14,000, Netherlands 12,000, Russia 10,000, Singapore, UAE, China…) are forged: they aren’t attacking, they’re the victims the attacker would like our replies to rain down on.
• Bandwidth test (port 2000) — 1,800 hits, 100% from Turkey. Here the source is real, because TCP needs the handshake: a genuine prober.
• SYN scans — real source here too: Bulgaria (1,234), Italy (1,086), the United States (596), Germany, the Netherlands. These are the real “let’s try the handles”.

The hour’s scoreboard

Suricata’s verdict

Suricata inspected the whole stream. 245 alerts in the hour, all of a single kind: “too many TCP handshakes with different SYNs”, the signature of scan noise. No exploit, malware or intrusion signature. It recognized and let normal traffic through (SIP, SNMP, QUIC). In one line: nothing hostile got in; the little that knocked was background noise, and Suricata labeled it as such.

And the machine?

Average CPU 1.8%, never above 4%. Free memory flat, from 1,601 to 1,595 MB. Active connections between 151 and 243. No queue, no alarm.

A normal hour, in short. Steady pressure on the door — the DNS amp that won’t let up, a Turk insisting with the bandwidth test, the usual Bulgarian and Italian scanners — and on the other side a doormat that, at 2% CPU, says no to everyone.