nanog mailing list archives
Re: botnet reporting by AS - what about you?
From: "Christopher L. Morrow" <christopher.morrow () mci com>
Date: Sat, 13 Aug 2005 03:55:12 +0000 (GMT)
On Sat, 13 Aug 2005, Fergie (Paul Ferguson) wrote:
Chris, I can assure you that the Drone Army project is not run that way, and is quite useful, effective, etc. The folks behind the DA Project are certainly professionals... ...and the infromation is quite useable, parse-able, and genuine.
cool, among the 800k+ complaints we see a month (yes, 800k) there are quite a few completely useless ones :( Anything sent in as a complaint has to have complete and useful information, else it's hard/impossible to action properly. It'd help if the format it was sent in was also machine parseable :) With 800k+ complaints/month I'm not sure people want to spend time figuring each one out, a script/machine should be doing as much as possible.
- ferg -- "Christopher L. Morrow" <christopher.morrow () mci com> wrote: perhaps we could back up and ask: 1) why are you not using the arin/ripe/apnic/japnic/krnic/lacnic poc's for these asn's? certainly some are not up to date, but there are a large number that are... 2) what is this for again? 3) are you planning on sending something to these poc's? 4) what are you planning on sending to them? 5) how often should they expect to see something, and from 'whom'? 6) looked at the INCH working group in IETF, thought about using some of these evolving standards for your alerts/messags/missives? 7) please don't send in bmp files of traceroutes (make the info you send in complete and usable... 'I saw a bot on ip 12' is not useable, as an fyi) -Chris -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg () netzero net or fergdawg () sbcglobal net ferg's tech blog: http://fergdawg.blogspot.com/
Current thread:
- botnet reporting by AS - what about you? Gadi Evron (Aug 12)
- Re: botnet reporting by AS - what about you? Richard A Steenbergen (Aug 12)
- Re: botnet reporting by AS - what about you? Rick Wesson (Aug 12)
- Re: botnet reporting by AS - what about you? Gadi Evron (Aug 12)
- Re: botnet reporting by AS - what about you? Christopher L. Morrow (Aug 12)
- Re: botnet reporting by AS - what about you? Peter Dambier (Aug 13)
- Re: botnet reporting by AS - what about you? Christopher L. Morrow (Aug 13)
- Re: botnet reporting by AS - what about you? Richard A Steenbergen (Aug 12)
- <Possible follow-ups>
- Re: botnet reporting by AS - what about you? Hannigan, Martin (Aug 12)
- Re: botnet reporting by AS - what about you? Christopher L. Morrow (Aug 12)
- Re: botnet reporting by AS - what about you? Fergie (Paul Ferguson) (Aug 12)
- Re: botnet reporting by AS - what about you? Christopher L. Morrow (Aug 12)
- Re: botnet reporting by AS - what about you? Fergie (Paul Ferguson) (Aug 12)
- Re: botnet reporting by AS - what about you? James Baldwin (Aug 15)
- Re: botnet reporting by AS - what about you? william(at)elan.net (Aug 16)
- Re: botnet reporting by AS - what about you? James Baldwin (Aug 15)
- Re: botnet reporting by AS - what about you? Hannigan, Martin (Aug 12)
- Re: botnet reporting by AS - what about you? Christopher L. Morrow (Aug 12)
- Re: botnet reporting by AS - what about you? Fergie (Paul Ferguson) (Aug 12)