[57390] in North American Network Operators' Group
Re: Abuse.cc ???
daemon@ATHENA.MIT.EDU (Jeff Kell)
Sat Apr 5 00:56:44 2003
Date: Sat, 05 Apr 2003 00:55:58 -0500
From: Jeff Kell <jeff-kell@utc.edu>
To: "McBurnett, Jim" <jmcburnett@msmgmt.com>
Cc: Simon Lyall <simon.lyall@ihug.co.nz>, nanog@merit.edu
Errors-To: owner-nanog-outgoing@merit.edu
McBurnett, Jim wrote:
> I tell ya, what really gets me in a bad mood is when my PIX logs
> show the same IP address hitting port 80 on 25 different IP's
> and the time line is 2 seconds start to finish.
> Yesterday, I got word from a network operator that 50 entries was not sufficient.
> So I parsed 4 days's worth and sent them over 1200 messages from their block..
> have not heard back yet..
Well, if you find out, let me know. On Apr 2 we had (among others):
101233 hits on 445 from 203 sources,
43465 hits on 139 from 218 sources,
14399 hits on 80 from 1922 sources,
12106 hits on 21 from 6 sources,
etc.
And we would barely qualify as a "small" operation...
Then we have the nutcases than scan a dozen or so proxy ports per host
on a /17 netblock (APNIC source space, usually).
Unless its a DoS and in the millions, I wonder how many outfits still
give a flying fornication at a cyclically motivated glazed pastry anymore.
Jeff
