To test it, let's get two computers on the same local area network, e.g. connected to Wi-Fi on the same home modem router.
On computer B:
- find computer IP with the
ipCLI tool. Suppose it is 192.168.1.102 - then run Ciro's
ncHTTP test server
Output on terminal 1:TODO understand them all! Possibly correlate with Wireshark, or use
17:14:22.017001 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [S], seq 2563867413, win 64240, options [mss 1460,sackOK,TS val 303966323 ecr 0,nop,wscale 7], length 0
17:14:22.073957 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [S.], seq 1371418143, ack 2563867414, win 65160, options [mss 1460,sackOK,TS val 171832817 ecr 303966323,nop,wscale 7], length 0
17:14:22.074002 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [.], ack 1, win 502, options [nop,nop,TS val 303966380 ecr 171832817], length 0
17:14:22.074195 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [P.], seq 1:82, ack 1, win 502, options [nop,nop,TS val 303966380 ecr 171832817], length 81
17:14:22.076710 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [P.], seq 1:80, ack 1, win 510, options [nop,nop,TS val 171832821 ecr 303966380], length 79
17:14:22.076710 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [.], ack 82, win 510, options [nop,nop,TS val 171832821 ecr 303966380], length 0
17:14:22.076727 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [.], ack 80, win 502, options [nop,nop,TS val 303966383 ecr 171832821], length 0
17:14:22.077006 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [F.], seq 82, ack 80, win 502, options [nop,nop,TS val 303966383 ecr 171832821], length 0
17:14:22.077564 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [F.], seq 80, ack 82, win 510, options [nop,nop,TS val 171832821 ecr 303966380], length 0
17:14:22.077578 IP ciro-p14s.55798 > 192.168.1.102.8000: Flags [.], ack 81, win 502, options [nop,nop,TS val 303966384 ecr 171832821], length 0
17:14:22.079429 IP 192.168.1.102.8000 > ciro-p14s.55798: Flags [.], ack 83, win 510, options [nop,nop,TS val 171832824 ecr 303966383], length 0-A option to dump content.Amazing tool that captures packets and disassembles them. Allows you to click an interactive tree that represents Ethernet, TCP/IP and application layer like HTTP.
Start capture immediately from CLI, capture packets to/from 192.168.1.102:
sudo wireshark -f 'host 192.168.1.102' -kCapture by instead:
sudo wireshark -f http -k
sudo wireshark -f icmp -kFilter by both protocol and host:
sudo wireshark -f 'host 192.168.1.102 and icmp' -kFor application layer capture filtering, the best you can do is by port:There is an
sudo wireshark -f 'tcp port 80'http filter but only for as a wireshark display filterSample usage:This produces simple one liners for each request.
sudo tshark -f 'host 192.168.1.102What you likely want is the
-V option which fully disassembles each frame much as you can do in the GUI Wireshark:sudo tshark -V -f 'host 192.168.1.102TODO didn't manage to get it working with TP Link ARCHER VR2800 even though it shows DHCP as enabled and it also shows MAC addresses and corresponding hostnames in the router management interface.
For IP-level communication, askubuntu.com/questions/22835/how-to-network-two-ubuntu-computers-using-ethernet-without-a-router/116680#116680 just worked between P51 and P14s both on Ubuntu 23.10 connected with a regular Cat 5e cable.
On both machines, first we found the Ethernet cable interface name with the which outputs on the P41s:so the interface was
ip CLI tool:ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp1s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether fc:5c:ee:24:fb:b4 brd ff:ff:ff:ff:ff:ff
3: wlp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 04:7b:cb:cc:1b:10 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.123/24 brd 192.168.1.255 scope global dynamic noprefixroute wlp2s0
valid_lft 61284sec preferred_lft 61284sec
inet6 fe80::3597:15d8:74ff:e112/64 scope link noprefixroute
valid_lft forever preferred_lft foreverenp1s0f0, because wlp is wireless and lo is localhost.So on the P14s we assign an IP of 10.0.0.10 to the P51:
sudo ip address add 10.0.0.10/24 dev enp1s0f0Then on the P51 analogously, giving IP of 10.0.0.20 to the P14s:
sudo ip address add 10.0.0.20/24 dev enp0s31f6And after that, P14s can:and P51 can:
ping 10.0.0.10ping 10.0.0.20TODO after a few seconds, the settings appear to be forgotten, and
ping stops working unless you do sudo ip address add on the local machine again. This seems to happen after a popup appears saying "Activation of network connection failed" as it fails to obtain Internet from the cable.This one is not generally seen by software, which mostly operates starting from OSI layer 2.
A good project to see UARTs at work in all their beauty is to connect two Raspberry Pis via UART, and then:
- type in one and see characters appear in the other: scribles.net/setting-up-uart-serial-communication-between-raspberry-pis/
- send data via a script: raspberrypi.stackexchange.com/questions/29027/how-should-i-properly-communicate-2-raspberry-pi-via-uart
Part of the beauty of this is that you can just connect both boards directly manually with a few wire-to-wire connections with simple jump wire. Its simplicity is just quite refreshing. Sure, you could do something like that for any physical layer link presumably...
Remember that you can only have one GNU screen connected at a time or else they will mess each other up: unix.stackexchange.com/questions/93892/why-is-screen-is-terminating-without-root/367549#367549
On Ubuntu 22.04 you can screen without sudo by adding yourself to the
dialout group with:sudo usermod -a -G dialout $USERWhen non-specialists say "Ethernet cable", they usually mean twisted pair for Ethernet over twisted pair.
But of course, this term is much more generic to a more specialized person, since notably fiber optics are also extensively used in Ethernet over fiber.
This is the most common home "ethernet cable" as of 2024. It is essentially ubiquitous. According to the existing Ethernet physical layer, the maximum speed supported is 2.5 Gbit/s.
Cat 5e cable stripped
. Source. The frequency range of Wi-Fi, which falls in the microwave range, is likely chosen to allow faster data transfer than say, FM broadcasting, while still being relatively transparent to walls (though not as much).
There is no userland process for it, it is handled directly by the Linux kernel: unix.stackexchange.com/questions/439801/what-linux-process-is-responsible-for-responding-to-pings/768739#768739
Bibliography:
- some good interview excerpts with some of the pioneers on Glory of the Geeks
- askubuntu.com/questions/1422263/rdp-on-ubuntu-desktop-22-04/1568077#1568077
- askubuntu.com/questions/1499789/enable-rdp-from-command-line/1568059#1568059
- askubuntu.com/questions/514889/what-is-the-default-vnc-server-included/1565098#1565098
- askubuntu.com/questions/1482111/how-to-restore-remote-desktop-after-internet-connection-loss-without-reboot-on-u
Hardcoded and unique network addresses for every single device on Earth.
Started with 48 bits (6 bytes), usually given as 01:23:45:67:89:AB but people now encouraged to use 64-bit ones.
How they are assigned: www.quora.com/How-are-MAC-addresses-assigned Basically IEEE gives out the 3 first bytes to device manufacturers that register, this is called the organizationally unique identifier, and then each manufacturer keeps their own devices unique.
The Internet Protocol by Ben Eater (2014)
Source. A "DNS database" is a database that stores DNS records, notably A-records, which IP a domains is hosted at.
For currently live domains, domain to IP can of course be easily determined on the fly by just resolving the domain like the browser does, e.g.
cirosantilli.comWhat is hard however is:
As of 2023, working with DNS data is just going through a mish-mash of closed datasets/expensive APIs.
We really need some open data in that area.
- opendata.stackexchange.com/questions/1951/dataset-of-domain-names
- opendata.stackexchange.com/questions/2110/domain-name-system-record-a-database
- webmasters.stackexchange.com/questions/33395/find-the-ip-address-of-expired-domains/142751#142751
- superuser.com/questions/686195/how-to-find-the-last-ip-used-for-an-expired-domain-name/1793224#1793224
Some links of interest:
- bushart.org/topic/ip
- archive.org/details/internet-mapping
- stackoverflow.com/questions/307553/possible-to-download-entire-whois-database-list-of-registered-domains (deleted question, see archives)
- www.reversedns.ch/en/ has some OK reverse IPs, but you have to do them one by one with CAPTCHA, and we were already past that point when that source was found, so nothing new was found on it yet
- iphistory.net/ announced at www.reddit.com/r/OSINT/comments/1bip8j7/iphistorynet_find_historic_ip_addresses_from/
Bibliography:
- www.reddit.com/r/OSINT/comments/1j8uasm/does_domaintools_offer_historical_reverse_ip_ie/ by Ciro Santilli
- www.reddit.com/r/OSINT/comments/ne27qi/really_historical_whois/
- www.reddit.com/r/dns/comments/1f4y0mg/any_onestopshop_type_sites_that_are_better_for/
- www.arin.net/reference/research/whowas/ you need to request access and they need to approve your usage. Bastards.
They do have historic reverse IP search at dns-history.whoisxmlapi.com/api but their data is not obviously more complete than viewdns.info, e.g.: as of March 2025:Their whois data seems much better quality however.
- 62.22.60.56
- viewdns.info/reverseip/?t=1&host=62.22.60.56 has traveltimenews.com from 2011
- dns-history.whoisxmlapi.com/api is empty
- 66.175.106.158
- viewdns.info/reverseip/?host=66.175.106.158&t=1 has a hit from 2011
- dns-history.whoisxmlapi.com/api is empty
As of 2025, you can do historical whois for free on the API demo under whois-history.whoisxmlapi.com/ but it only shows the 3 newest records.
To unlock that, you have to create an account, which gives you 500 credits, and then:They do normalize Gmail dot trick, but not for the
- tools.whoisxmlapi.com/whois-history-search: each full historical whois report for a domain costs 50 points
- tools.whoisxmlapi.com/reverse-whois-search: each historical reverse whois search search costs 1 point
googlemail trick.TODO do they offer historical reverse IP?
assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/708941/255941323840717-pricing-document-2024-04-17-1304.pdf is an epic document under the gov.uk domain and marked:and marks Iris Investigate as starting at $15k USD for 250 Queries / Month
HIGHLY CONFIDENTIAL - For use only by DomainTools employees and other audiences under NDA only
Acquired by DomainTools in 2021. ChatGPT says it was the most complete DB ever.
Some interesting analysis by Parth Shukla twitter.com/pparth | www.linkedin.com/in/parth-shukla-59583b20/:
Apparently most of the routers were Chinese. No surprise there.
This is the most accessible DNS database online, as it does not require login or payment.
They have reasonable data. It's not fully complete as Ciro Santilli saw on CIA 2010 covert communication websites, but it is very valuable.
Tested as of 2025, they seem to have removed the pre-IP checks on web interface, and just instead use Cloudfare to check that you are human from time to time, which allows for a lot manual searching to be done! Awesome!
Previously, tou could only get about 250 queries on the web interface, then 250 queries per free account via API. They check your IP when you signup, and you can't sign in twice from the same IP. They also state that Tor addresses are blacklisted. They also normalize dots in gmail addresses, so you need more diverse email accounts. But they haven't covered the
.gmail vs .googlemail trick.Their data is also quite disjoint from the data of the 2013 DNS Census. There is some overlap, but clearly their methodology is very different. Some times they slot into one another almost perfectly.
Very curiously, their reverse IP search appears to be somewhat broken, or not to be historic, e.g.We've contacted viewdns.info support and they replied:This is likely not accurate, more precisely it likely only works if it was the last IP address, not necessarily a current one.
- viewdns.info/iphistory/?domain=vuvuzelanews.com hits 74.116.72.246 in 2011, later moved to others
- viewdns.info/reverseip/?host=74.116.72.246&t=1 however does not contain
vuvuzelanews.com
The reverse IP tool will only show a domain if that is it's current IP address.
Some interesting usages:
The CIA really likes this registrar, e.g.:
- CIA 2010 covert communication websites
- 2014 www.newsweek.com/former-cia-officials-ready-defend-agency-after-torture-reports-release-290383A group of former CIA officials are gearing up to defend the agency when the Senate releases its long-awaited report investigating "enhanced interrogation" tactics used on prisoners after 9/11. The highlight of their PR push will be a website, "CIASAVEDLIVES.COM," which is set to go live when the report is released on Tuesday, Foreign Policy reported.
Some cool ones:
- playinside.me
Archive example: web.archive.org/web/20130726224338/http://librarianhelper.com/
As of 2021, Ciro Santilli feels strongly that Amazon originals are so much sillier compared to Netflix ones in average.
Of course, everything pales in comparison to The Criterion Collection.
Jeff has spoken a lot in public about Amazon, perhaps even more than other comparable founders, see e.g. Section "History of Amazon". Kudos for that.
Jeff Bezos Unveiling the Blue Origin Lunar Lander
. Source. Order from Bulgaria by Jeff Bezos
. Source. From a 2002 talk at MIT.Her neck is huge! She also redid her teeth at some point apparently. Some good photos at: www.irishtimes.com/life-and-style/people/mackenzie-scott-how-the-former-mrs-bezos-became-a-philanthropist-like-no-other-1.4850049
MacKenzie Bezos' new husband after she divorced Bezos.
www.dailymail.co.uk/femail/article-9338723/Who-billionaire-Mackenzie-Scotts-new-husband-Dan-Jewett.html Who IS billionaire Mackenzie Scott's new husband Dan Jewett?
Articles were limited to the first 100 out of 241 total. Click here to view all children of Computer network.
Articles by others on the same topic
There are currently no matching articles.

