Many new attacks are automated or modified versions of old techniques for stealing passwords, looking for unprotected systems, and other long-tested approaches. For a long time people were shooting at us blind. But if they know where all the machines are, they can send targeted attacks, which are harder to pick up, and have a greater chance of success. Northcutt cited the use of domain-name system queries to determine which IP addresses are connected to actual computers. By sending queries to a string of Internet addresses, a potential attacker can find out which are live.
Probes appear genuine requests for Web pages, as if someone mistyped an address.
By compiling a list of bad addresses, an attacker can develop a list of IP addresses that do have computers attached to them, and focus on those. Sometimes it takes a while to pay for your sins. The evolution of cracking techniques makes it even more critical that the defense community work closely together. Defenders must share data in order to recognize and ward off coordinated attacks against infrastructure facilities or multiple targets. Several online clearinghouses provide information on publicly known software weaknesses and attack methods.