[166818] in North American Network Operators' Group
Re: Automatic abuse reports
daemon@ATHENA.MIT.EDU (William Herrin)
Tue Nov 12 23:04:07 2013
In-Reply-To: <3f84cdf1787be33a323b060bdfcdedef@www.circlenet.us>
From: William Herrin <bill@herrin.us>
Date: Tue, 12 Nov 2013 23:03:31 -0500
To: sam@circlenet.us
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Tue, Nov 12, 2013 at 9:07 PM, Sam Moats <sam@circlenet.us> wrote:
> That said the original poster was
> focused on a DOS event,to do that you really don't need the full handshake.
Point. Though not all DDOSes are created equal. The simple packet
flood is, as likely as not, from forged addresses. But I've also seen
DDOSes which make repeated HTTP GET requests. That's tough to do
without control of the source address.
> Now it would be trivial to setup syslog and sshd to give only the sessions
> that complete the handshake, however I'm also not sure how responsive some
> of the abuse contacts may be. I'll keep my restrictive network settings for
> the time being.
That's the main problem: you can generate the report but if it's about
some doofus in Dubai what are the odds of it doing any good?
Regards,
Bill Herrin
--
William D. Herrin ................ herrin@dirtside.com bill@herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004
