[151989] in North American Network Operators' Group
Re: SORBS?!
daemon@ATHENA.MIT.EDU (chris)
Fri Apr 6 21:55:47 2012
In-Reply-To: <CAAAwwbUfoEMr8G7sPsh_u8n7R-cSS9zyOwA72QpJoOOqPGCLVg@mail.gmail.com>
Date: Fri, 6 Apr 2012 21:55:17 -0400
From: chris <tknchris@gmail.com>
To: Jimmy Hess <mysidia@gmail.com>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
i dont think anyone would miss sorbs if it was gone, dare i say it not even
a single person
On Fri, Apr 6, 2012 at 9:48 PM, Jimmy Hess <mysidia@gmail.com> wrote:
> On Fri, Apr 6, 2012 at 8:13 PM, Jeroen van Aart <jeroen@mompl.net> wrote:
> > Brielle Bruns wrote:
> > to come from such a block is more often than not a necessity. It's very
> > unlikely to see 1 abuser in between an otherwise perfectly behaving
> network
> > neighbourhood.
>
> That's kind of vague to say it's "unlikely to see 1 abuser". What is
> the probability that
> more IPs in the same /24 are likely to harbor abusers, given that you
> have
> received abuse from one IP?
>
> And how have you discovered this?
> ( What is the criteria used to determine that it is unlikely, and what
> is your source of the information?)
>
> Are you assuming that if you've seen the abuse, that you probably
> weren't the first victim,
> that the ISP has probably already been notified by someone else,
> that they have likely had a
> reasonable amount of time to put a stop to the abuse, and that they
> failed to do so?
>
>
> There is the one good case where a single abuser has a dynamic IP address;
> but it's not a safe assumption that they will live in the same /24
> next time the abuser dials in.
>
> So not only does listing an entire /24 list innocent users' IP
> addresses,
> it also does not necessarily effectively list the one abuser.
>
> --
> -JH
>
>
