[95908] in North American Network Operators' Group
Re: Abuse procedures... Reality Checks
daemon@ATHENA.MIT.EDU (Douglas Otis)
Mon Apr 9 18:05:29 2007
In-Reply-To: <g3wt0murbx.fsf@sa.vix.com>
Cc: nanog@merit.edu
From: Douglas Otis <dotis@mail-abuse.org>
Date: Mon, 9 Apr 2007 15:04:09 -0700
To: Paul Vixie <vixie@vix.com>
Errors-To: owner-nanog@merit.edu
On Apr 8, 2007, at 9:03 PM, Paul Vixie wrote:
> dotis@mail-abuse.org (Douglas Otis) writes:
>
>> Good advise. For various reasons, a majority of IP addresses
>> within a CIDR of any size being abusive is likely to cause the
>> CIDR to be blocked. While a majority could be considered as being
>> half right, the existence of the "bad neighborhood" demonstrates a
>> lack of oversight for the entire CIDR, which is also fairly
>> predictive of future abuse.
>
> that sounds like a continuum, but my experience requires more
> dimensions than you're describing. for example, this weekend two /
> 24's were hijacked and used for spam spew.
Agreed.
This was expressed recently as well.
http://www.merit.edu/mail.archives/nanog/msg05351.html
CIDRs should also conform with ASN boundaries and reputation tracks
with announcements.
Unfortunately an effort to create a black-hole operator's BCP failed
to consider these issues. Many building their own reputation
histories will also likely ignore this concern. This means John's
advice remains valid, whether fair or not. Adopting transient
tracking methods cope with this problem.
-Doug
