Is it normal behavior of tpot connecting tons of udp-ressources of jami/dhtproxy

[KmdKeen]

Hello,

we're kind of concerned that our tpot is rebooting at 5:30 daily via cron and after reboot instantly connects to resources like dhtproxy2.jami.net via UDP and transferring lots of data? We have tons of connections to this network via udp without any reference, what this network is doing for the tpot.

Best regards,

Sebastian

[KmdKeen]

Looks like these sessions are part of the sentrypeer honeypot and are resulting tpot in showing several sentrypeer-alerts promoted by other honeypots... am I right? This is very confusing!

[KmdKeen]

@KmdKeen You may want to run /opt/tpot/update.sh to account for the changes.

Awesome! We're P2P-traffic-free now! Thanks alot!

[t3chn0m4g3]

@KmdKeen Awesome and thank you for taking the time for testing / opening the discussion.

[ghenry]

Come back soon though!

[KmdKeen]

You're welcome! Glad that this was not what we thought at first :D keep up the good work!

[t3chn0m4g3]

Yes I bet, that's why I took action right away :)
Thank you!

[t3chn0m4g3]

we're kind of concerned that our tpot is rebooting at 5:30 daily via cron

This is normal behavior, documented here.

[KmdKeen]

Yeah this is fine... we were not concerned about the reboot but the behavior right after ;)

[t3chn0m4g3]

Just did not want to leave this part unanswered