logoalt Hacker News

augusto-mouralast Sunday at 5:18 PM1 replyview on HN

Battleship sounds like a good analogy, but is very different because you don't have other options to "secure your ship" besides obscurity. If you had other options, let's say a sonar or moving your ship, they would definitely be used along with obscurity.

Besides, the time to scan the whole board is too time consuming in a battleship game, but scanning the whole internet on the other hand only take a few minutes[1]

[1]: https://github.com/robertdavidgraham/masscan


Replies

bb88today at 4:34 AM

You're talking IPv4 here, not IPv6. A 24 bit network has 254 addresses in IPv4. A 64bit subnet in IPv6 has 2^64.

If you can scan 1M ipv6's in a second, you can maybe scan 1 subnet in 584,942 years.

So if you're a firewall, and you notice scanning from a particular ip or network, it's easy enough to block them.

Also if you are scanning IPv4, you're not scanning addresses behind the NAT'd routers -- which is also effectively a form of obfuscation. So I would argue it's not the entire internet.