[90497] in North American Network Operators' Group
Re: Are botnets relevant to NANOG?
daemon@ATHENA.MIT.EDU (Fergie)
Fri May 26 18:44:56 2006
From: "Fergie" <fergdawg@netzero.net>
Date: Fri, 26 May 2006 22:42:29 GMT
To: peter@peter-dambier.de
Cc: nanog@merit.edu
Errors-To: owner-nanog@merit.edu
Not effective against botnets.
Think of it this way, thousands of compromised hosts (zombies),
distributed to the four corners of the Internet, hundreds (if
not thousands) of AS's -- all recieving their instructions via
IRC from a C&C server somewhere, that probably also may change
due to dynamic DNS, or pump-and-dump domain registrations, or
any other various ways to continually move the C&C.
Simply going after (what may _seem_to_be_) the last-hop router
is like swinging a stick after a pi=F1ata that you can't actually
reach when you are blind-folded. :-)
- ferg
-- Peter Dambier <peter@peter-dambier.de> wrote:
Just an afterthought, traceroute and take the final router. I guess for
aDSL home users you will find some 8 or 11 routers in germany. My final
router never changes. Of course there can hide more than one bad guy
behind that router.
[snip]
--
"Fergie", a.k.a. Paul Ferguson
Engineering Architecture for the Internet
fergdawg@netzero.net or fergdawg@sbcglobal.net
ferg's tech blog: http://fergdawg.blogspot.com/
