Default File Template

Objective

Define a curated list of Intel ME FQDNs/IP blocks. No Ethernet frame whose payload matches known OEM telemetry endpoints (Intel ME, Lenovo solutions, etc.) may be emitted during a 24-hour observation window when the device generates no legitimate traffic.

Key Result

Run tcpdump on a separate span-port for 24 h; count frames destined to Intel ASNs 4983, 10297, 1668, etc.

Test: #+begin_src tcpdump -i eno1 -w /tmp/24h.pcap & sleep 86400 && pkill tcpdump tshark -r /tmp/24h.pcap -Y 'ip.dst_host[email protected]' | wc -l #+end_src_ Expected output:

0