[140356] in North American Network Operators' Group
Re: 23,000 IP addresses
daemon@ATHENA.MIT.EDU (William Pitcock)
Tue May 10 10:38:05 2011
Date: Tue, 10 May 2011 09:37:23 -0500
From: William Pitcock <nenolod@systeminplace.net>
To: Christopher Morrow <morrowc.lists@gmail.com>
In-Reply-To: <BANLkTimuxBJmf_YWrjqDmHYtoK-oD6M-CQ@mail.gmail.com>
Cc: NANOG list <nanog@nanog.org>, Scott Brim <scott.brim@gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Tue, 10 May 2011 10:22:03 -0400
Christopher Morrow <morrowc.lists@gmail.com> wrote:
> On Tue, May 10, 2011 at 10:15 AM, Scott Brim <scott.brim@gmail.com>
> wrote:
> > On Tue, May 10, 2011 at 09:42, Leigh Porter
> > <leigh.porter@ukbroadband.com> wrote:
> >> So are they basing this on you downloading it or on making it
> >> available for others?
> >
> > Without knowing the details, I wouldn't assume any such level of
> > competence or integrity. =A0It could just be a broad witch hunt.
>=20
> I know of a decent sized global ISP that ran (runs?) a large darknet
> that was the equivalent of a few /16's routed to a fbsd host running
> 'tcpdump' (a tad more complex, but essentially this). BayTSP (one of
> the 'make legal threats for the mpaa/riaa' firms) sent ~2k notes to
> the ISP about downloaders on these ips.
>=20
> Looking at netflow data (sample 1:1 on that interface) they had
> portscanned (from ip space registered in their name) each address in
> the range and sent subpoena-material to all ips that they thought they
> got a response from.
>=20
> At least baytsp got theirs? (money I mean)
>=20
Do you have any links to evidence of this? I would love to just be
able to automatically throw BayTSP mails in the garbage, but I can't
just blindly do it if there is any chance of them being legitimate.
William
