Re: How to cope with, uhm, "mentally challenged" abuse personnel?

[Utopian Admin <admin () UTOPIA2 COM>]

Escalation works, some of the time.  When I was in circut support, many
moons ago, we could escalate issues with AT&T and MCI until they were under
direct scrutiny by their district managers/VPs.  I'm sure the lackeys you're
speaking to aren't the heads of the UUNET security department ;)

Mike.

-----Original Message-----
From: Incidents Mailing List [mailto:INCIDENTS () SECURITYFOCUS COM]On
Behalf Of Ralf G. R. Bergs
Sent: Saturday, March 03, 2001 3:20 AM
To: INCIDENTS () SECURITYFOCUS COM
Subject: How to cope with, uhm, "mentally challenged" abuse personnel?


Hi there,

I have to report about 1 incident per day that is caused by ip addresses
assigned to UUnet. Mostly it's sweeps across our whole class C, sometimes
ICMP, sometimes even scans for 111/UDP. NONE of our LAN IPs EVER leave our
LAN, since altho they're IPs officially assigned to us I masquerade (NAT)
them
at our router.

The usual answer I receive from UUnet is the following:

    "The type of internet traffic you describe appears to be of normal
origin."

As I explained above NONE of our LAN IPs ever can be seen outside of our
LAN,
so HOW ON EARTH should this be "of normal origin???"

Frankly I'm fed up with this kind of replies. I don't know whether it's just
that the abuse personnel simply is underqualified for their job, or whether
it's they simply can't cope with the growing number of incidents caused by
their customers, but I don't feel like accepting this kind of ignorance.

Any suggestions what I should do? If UUnet's personnel doesn't get their act
together I could be forced to completely black-hole their respective subnets
in our router.

Thanks,

Ralf


--
Sign the EU petition against SPAM:          L I N U X       .~.
http://www.politik-digital.de/spam/        The  Choice      /V\
                                            of a  GNU      /( )\
                                           Generation      ^^-^^