[151992] in North American Network Operators' Group
Re: SORBS?!
daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Fri Apr 6 23:03:30 2012
To: Jimmy Hess <mysidia@gmail.com>
In-Reply-To: Your message of "Fri, 06 Apr 2012 20:48:44 -0500."
<CAAAwwbUfoEMr8G7sPsh_u8n7R-cSS9zyOwA72QpJoOOqPGCLVg@mail.gmail.com>
From: Valdis.Kletnieks@vt.edu
Date: Fri, 06 Apr 2012 23:02:18 -0400
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
--==_Exmh_1333767738_1945P
Content-Type: text/plain; charset=us-ascii
On Fri, 06 Apr 2012 20:48:44 -0500, Jimmy Hess said:
> That's kind of vague to say it's "unlikely to see 1 abuser". What is
> the probability that
> more IPs in the same /24 are likely to harbor abusers, given that you have
> received abuse from one IP?
It's similar to pirhanas or cockroaches - they can't be found everywhere, but
if you spot one in a location, there's a near certainty that there's plent more
in the area.
Or if you don't like that, you can run a simple Monte Carlo simulation. Assume
256 customer slots, and that initially, there is a 3% chance that the next
customer to arrive is evil. Also add a feedback - each time you terminate an
evil customer in less than the average arrival time, the chance the next
customer is evil is cut by 10% of the current value. Each time an evil
customer is allowed to last 3 times the average arrival time, the chance of an
evil customer goes up 10%. Simulate for various termination times for
evil customers.
Are there any steady-state solutions where the *average* number of evil
users is one? Or does it decay down towards zero or upwards towards
a high number?
--==_Exmh_1333767738_1945P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iQIVAwUBT3+uOgdmEQWDXROgAQLDKg//REVZsdvN55vcrqvddcWyhpIxfLOkGdsL
xup8GEsSTFzJc2d1LnnIcXkmhJfcpGxoM36wrs8pQlKkNQbtmw3/3gCDg29PiYIK
knGW7itkVUtbcLI2DZuczHMzz9q6oVCfkgJU3JeN4ixgMgAr/B19qF7i7n/19Rdr
dodv5YoXI8zKWwUt74oWJJseO9V1Qy94JqHV28KLWJ9YbtB4fp50/mKn7Z94gPQV
xV/Yxxck5TjMMWqIrLC3pOxtkVivnfmz4vJX/Rv7RuQWU5yXIO70JdNvDyJKfJgb
tBLtwgAOyt1a+64+AY+MdxFePRqQSqwcazkXckSYsKP5YxkvGTkEmsLmoP9URW9N
tz2cOMlqsCJxQnJkEgjGqUT3SGTVbuq+Qatt3uzZbJSmZT1YuPTWqg8/JnbcwjSD
B33AkZ5MHRHbPYa4pNf6lvNEMHc5TYYFyDKJkTffMkNAXwN12Geifjlxh47ss48x
iVF6KYTEChCfAVBX4Hf2jjDYbiJQ7fjnM5fLjKpNvq/nojoJ6QbiLftXWQOlLx6F
o8hmkcu9YTM+x3ZQBeVrSv0AEl4ra91XE5MorEMrS+LPjjebRCN187jytUDcSy7M
opUBCi3deC3JjnVUaU2ZQAwwxJ89qc83jrbp7SJCwYG3HvND/twhzCgLMTa+DSAp
t0zej8/oISA=
=4euF
-----END PGP SIGNATURE-----
--==_Exmh_1333767738_1945P--
