How to simulate (Chinese) attackers
To make your logs look interesting and have certain attackers stand out, we will configure our IT firewall to route into and out of a VLAN with the 222.222.222.0/24 IP subnet range. The range will show up in location-aware tools as coming from China. What else stands out like a sore thumb more than suspicious traffic from or to China?
To accomplish this, we will virtually wire up the IT firewall to a dedicated vSwitch and assign the connected interface of the firewall with the 222.222.222.1 IP address:
Figure 19.12 – IT firewall interface configuration
This will put the 222.222.222.0 subnet into the firewall's routing table and send traffic from and to that subnet to the assigned interface. Next, we will connect a copy of Kali Linux to the same vSwitch for the China subnet and assign it an IP address of 222.222.222.222, with a default gateway of 222.222.222.1:
Figure 19.13 – Configuring...
