[77898] in North American Network Operators' Group
Re: Collecting PTR names or IP addresses (Was: Re: IRC Bot list
daemon@ATHENA.MIT.EDU (Gadi Evron)
Mon Feb 14 04:28:22 2005
Date: Mon, 14 Feb 2005 11:29:53 +0200
From: Gadi Evron <gadi@tehila.gov.il>
To: Ketil Froyn <kfroyn@gnr.com>
Cc: nanog@nanog.org
In-Reply-To: <1108136753.6611.79.camel@ketil>
Errors-To: owner-nanog-outgoing@merit.edu
Ketil Froyn wrote:
>>>http://www.albany.edu/~ja6447/hacked_bots8.txt
>
>
> Isn't it a good idea to collect the IP addresses rather than the ptr
> name? For instance, if I were an evil person in control of the ptr
> record of my own IP, I could easily make the name something like
> 1-2-3-4.dsl.verizon.net, and if you didn't collect my IP, you can never
> be sure you got the right details!
>
> Something like this is probably not very widespread (has anyone seen it
> in practice?), but I still think that for tracking purposes, ptr records
> are useless. IMHO.
You are right, people can change it to be whatever they like, potentially.
What if they wanted to change the IP?
Think about what you said, and you will see why you are wrong.
Gadi.
