During some recent bug bounty testing, I needed to record a pcap using Wireshark, then replay it repeatedly in order to stress test a locally hosted server (which is in-scope of the bounty program).
However, I unfortunately exported the pcap incorrectly, meaning that all sorts of other (internet-bound) traffic was in there. I then fuzzed this pcap using Mutiny.
So when replaying the fuzzed pcap, I accidentally sent out loads of fuzzed traffic to the internet, primarily to CDNs by the looks of it (essentially any website my computer had visited whilst recording the pcap).
This was an honest mistake, and I have now mitigated the problem by running Wireshark and the packet replay tool as a Linux group that has internet access blocked with iptables.
My concern is that I may have broken some form of computer misuse law by sending this traffic. There was obviously no intent as this was a mistake, and I didn't visibly see any results from sending the traffic, however of course there could have been an impact to the remote server - I guess I'll never know.
Has anybody experienced this before? Did the police come knocking or is it nothing to worry about?