Re: Are botnets relevant to NANOG?

[Michael.Dillon () btradianz com]

> for this community would trend analysis with the best of who is getting 
> better and the worst of who is getting worse and some baseline counts be 

> enough for this group to understand if the problem is getting better.

Your 5-day numbers were very reminiscent of the
weekly CIDR report. I think that if you clean it
up for weekly submission then that would be 
useful to some. 

For instance, you only published data for two
categories of ASN. Where is the tier-1 data?
And numbers should cover a 7-day period, not
5 days. In addition, for each category you should
provide a fixed cutoff. The CIDR report shows
the top 30 ASNs. 

I think that the ideal would be a table 
including ASN category as one column and showing
the top 50 ASNs. In addition, you should attempt
to separate the dynamic addresses by some means 
or other and either add that as a separate column
or else do a separate table. Since this would
be posted weekly over a long period of time, it
is best to put some thought into how to structure
it so it remains relevant. 

Also, provide a URL where researchers can download
more complete datasets, not just top 50.

> I am suggesting that NANOG is an appropriate forum to publish general 
> stats on who the problem is getting better/worse for and possibly why 
> things got better/worse.

I think few people will complain about a weekly
posting of this nature.

--Michael Dillon