[166816] in North American Network Operators' Group
Re: Automatic abuse reports
daemon@ATHENA.MIT.EDU (William Herrin)
Tue Nov 12 20:44:03 2013
In-Reply-To: <8e46e18f60fef97dae75f61b4698fcf3@www.circlenet.us>
From: William Herrin <bill@herrin.us>
Date: Tue, 12 Nov 2013 20:43:28 -0500
To: sam@circlenet.us
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Tue, Nov 12, 2013 at 4:52 PM, Sam Moats <sam@circlenet.us> wrote:
> We used to use a small perl script called tattle that would parse out the
> /var/log/secure on our *nix boxes, isolate the inbound ssh exploits, lookup
> the proper abuse contacts and report them. I haven't seen anything similar
> in years but it would be interesting to do more than null route IPs.
>
> The problem we had with the automated reporting was dealing with spoofed
> sources, we see lots of traffic that is obviously hostile but unless it
> becomes serious enough to impact performance we rarely report it. An
> automated system didn't seem to fit anymore due to false positives.
Hi Sam,
Out of curiosity -- how does one get a false positive on an ssh
exploit attempt? Does the origin IP not have to complete a 3-way
handshake before it can attempt an exploit?
Regards,
Bill Herrin
--
William D. Herrin ................ herrin@dirtside.com bill@herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004
