nanog mailing list archives
Re: Scanning (was Re: Stealth Blocking)
From: woods () weird com (Greg A. Woods)
Date: Sat, 26 May 2001 12:41:16 -0400 (EDT)
[ On Saturday, May 26, 2001 at 10:35:47 (-0400), Christopher A. Woodfield wrote: ]
Subject: Re: Scanning (was Re: Stealth Blocking) About two years ago the <vijay> promising local ISP </vijay> I worked for saw the number or ORBS-listed hosts withing its netspace go from ~400 to over 3,000 in one week.
Hmmmm.... you don't say exactly, but two years ago you were probably seeing the results of manual list entries (perhaps even entered as netblocks). Back then you had to be really smart and look at the value of the A RR returned from a DNS query into the database to be able to tell the difference between a proper ORBS entry and one of the supplemental manual entries. These days it's much more difficult to confuse the mechanical part of ORBS with the ego part.
Among the listings was a class C where EVERY HOST, 254 IPs, in the block was listed. Granted, each one was an open relay, but the point is that each IP was individually relay tested. When questioned about this, Alan Brown reponded that he had "received an unusually large number of nominations" for hosts in our netspace. Uh huh. Sure.
Do you have the mailer logs from those hosts? Can you prove that there was no other unauthorised use of them during the time *before* they were tested by ORBS? -- Greg A. Woods +1 416 218-0098 VE3TCP <gwoods () acm org> <woods () robohack ca> Planix, Inc. <woods () planix com>; Secrets of the Weird <woods () weird com>
Current thread:
- RE: Stealth Blocking, (continued)
- RE: Stealth Blocking Roeland Meyer (May 23)
- RE: Stealth Blocking David Schwartz (May 23)
- RE: Stealth Blocking jlewis (May 23)
- RE: Stealth Blocking David Schwartz (May 24)
- Scanning (was Re: Stealth Blocking) William Allen Simpson (May 24)
- Re: Scanning (was Re: Stealth Blocking) Joseph T. Klein (May 24)
- Re: Scanning (was Re: Stealth Blocking) Paul Vixie (May 24)
- Re: Scanning (was Re: Stealth Blocking) Mitch Halmu (May 24)
- Re: Scanning (was Re: Stealth Blocking) Greg A. Woods (May 24)
- Re: Scanning (was Re: Stealth Blocking) Christopher A. Woodfield (May 26)
- Re: Scanning (was Re: Stealth Blocking) Greg A. Woods (May 26)
- Re: Scanning (was Re: Stealth Blocking) William Allen Simpson (May 26)
- Re: Scanning (was Re: Stealth Blocking) William Allen Simpson (May 26)
- Re: Scanning (was Re: Stealth Blocking) Greg A. Woods (May 26)
- Re: Scanning (was Re: Stealth Blocking) William Allen Simpson (May 26)
- Re: Scanning (was Re: Stealth Blocking) Greg A. Woods (May 26)
- ORBS (Re: Scanning) E.B. Dreger (May 27)
- Re: ORBS (Re: Scanning) Randy Bush (May 27)
- Re: ORBS (Re: Scanning) J.D. Falk (May 27)
- RE: Stealth Blocking Roeland Meyer (May 23)
- Re: Scanning (was Re: Stealth Blocking) Steve Sobol (May 27)
- Re: Scanning (was Re: Stealth Blocking) Christopher A. Woodfield (May 27)