John Kristoff
LightNews LightNews
banner
jtk.infosec.exchange.ap.brid.gy
John Kristoff
@jtk.infosec.exchange.ap.brid.gy
41 followers 14 following 450 posts
UIC PhD candidate | https://Dataplane.org | Netscout. Internet infrastructure (#BGP, #DNS) and #infosec. Bit mechanic. Also: #Blues / tfr / #fedi22

🌉 bridged from ⁂ https://infosec.exchange/@jtk, follow @ap.brid.gy to interact
Posts Replies Media Videos
jtk.infosec.exchange.ap.brid.gy
This might win the the most unusual #bgp image in a paper award.
Hard to annotate this image that won't just confuse further. Maybe try yourself? https://arxiv.org/abs/2511.14467
November 21, 2025 at 8:23 PM
jtk.infosec.exchange.ap.brid.gy
On 2025-11-05 CAMTEL (#as15964) began announcing 4.0.0.0/8 and 8.0.0.0/8. Others announce more specific prefixes within them, but as the plot shows CAMTEL is now receiving an elevated amount of traffic to the corresponding, unannounced address space in these […]

[Original post on infosec.exchange]
Plot shows longitudinal plot of ingress/egress traffic for CAMTEL. A clear rise in ingress traffic, approximately 2x to 3x more than typical can be seen on ingress traffic since 2025-11-05.
November 18, 2025 at 5:19 PM
jtk.infosec.exchange.ap.brid.gy
I used Markdown encoding, which won't work for everyone. So here is an a image of the output if that helps anyone.
dig @1.1.1.1 foobar.gov +norecurse +nocmd +noquestion +noauthority +nostats ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1808 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232
October 30, 2025 at 12:19 AM
jtk.infosec.exchange.ap.brid.gy
+1 geek points if you spot the problem with this form
Web form with two fields. First first is labeled "EMAIL ADDRESS", second field is labeled "CONFIRM EMAIL ADDRESS". Both fields have example text of: email@website.com
October 27, 2025 at 3:15 PM
jtk.infosec.exchange.ap.brid.gy
Seen on the NordVPN Linux page. All links but one work. "How to disable IPv6 on Linux" is 404. Couldn't have said it better myself.

#ipv6
Screenshot of a NordVPN Linux client page. Text links include: Learn more about Linux security and configurations How to secure a Linux server or personal device NordVPN Linux release notes The most common types of Linux malware How to connect to NordVPN with IKEv2/IPSec on Linux Best Linux distributions for privacy and security How to connect to your dedicated IP on Linux How to disable IPv6 on Linux How to configure Linux Ubuntu setup How to get connection logs on Linux How to reset your application preferences on Linux
September 18, 2025 at 6:44 PM
jtk.infosec.exchange.ap.brid.gy
#ipv6 bizarro world, courtesy of whmyip [dot] com. Just me or IPv6=IPv4 for everyone.
Screen capture from a web site that claims to tell you what your IP address is. For the IPv4 address it shows an IPv6 address, partially redacted. For the IPv6 address it says Unable to detect IPv6.
August 4, 2025 at 2:39 PM
jtk.infosec.exchange.ap.brid.gy
In case this week's news was too upbeat for you, radioactive wasps now. https://orpspublic.doe.gov/orps/reports/displayReport2.asp?crypt=%87%C3%95%9Ba%8Evjtc%90
August 2, 2025 at 10:57 AM
jtk.infosec.exchange.ap.brid.gy
This was "packet rat". +2 points to id what pack is sitting on, +10 if you know the specific phone device to the rear.
Purple stuff rat sitting atop an old net chassis device, in the background is a rare ip phone. Specific product details in a follow up.
July 30, 2025 at 9:28 PM
jtk.infosec.exchange.ap.brid.gy
Chevy Chase doing the Saturday Night Weekend Update with caption: This just in Interdomain IP multicast is still dead
July 23, 2025 at 11:27 AM
jtk.infosec.exchange.ap.brid.gy
Picture of a credit card skimmer and website where you could purportedly get them ~2007. I couldn't find an archive of the site. I'm not sure if it was legit or not, but I remember seeing a few different pics advertising for it back then. This is just one of […]

[Original post on infosec.exchange]
Picture of a credit card skimmer with the URL overlaid (http://skimmers.us)
April 24, 2025 at 11:06 PM
jtk.infosec.exchange.ap.brid.gy
#thursdaythrowback Here is a ~20 year old plot showing the frequency distribution of client source port usage at an edu #dns resolver. Notice how the most common ports started at around 1024? That was Microsoft Windows. This picture should look a lot different if I were redraw this today.
Gnu plot visualization showing the distribution of src port usage. Biggest peak at ~1024. Also a lower peak at around ~49152. y-axis goes to over 100,000. x-axis goes from 0 to 65535 (but drawn to 10,000).
March 13, 2025 at 6:59 PM
jtk.infosec.exchange.ap.brid.gy
How has this not been repeatedly showing up in my timeline?
November 13, 2024 at 11:26 PM