Re: Abuse procedures... Reality Checks

2007-04-09 Thread J. Oquendo
Pete Templin wrote: John R Levine wrote: I don't have PI space, but I do have a competent ISP so I've never had any mail problems due to adjacent addresses. Having a competent ISP isn't a guarantee of exemption...only a contributor. As evidenced by the discussion, some people choose the

Re: Abuse procedures... Reality Checks

2007-04-09 Thread John L
I don't have PI space, but I do have a competent ISP so I've never had any mail problems due to adjacent addresses. Having a competent ISP isn't a guarantee of exemption...only a contributor. As evidenced by the discussion, some people choose the scope of their wrath arbitrarily. Nothing

Re: Abuse procedures... Reality Checks

2007-04-09 Thread Chris Owen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Apr 9, 2007, at 1:49 PM, John L wrote: I don't have PI space, but I do have a competent ISP so I've never had any mail problems due to adjacent addresses. Having a competent ISP isn't a guarantee of exemption...only a contributor. As

RE: Abuse procedures... Reality Checks

2007-04-09 Thread michael.dillon
I would have to respectfully disagree with you. When network operators do due diligence and SWIP their sub-allocations, they (the sub-allocations) should be authoritative in regards to things like RBLs. How do you tell when they have actually done due diligence. Existence of a SWIP record

RE: Abuse procedures... Reality Checks

2007-04-09 Thread Frank Bulk
The managed services they currently offer don't include egress filtering (L3 to L7) on their business customer's networks. From the discussion here it sounds like that naked pipes, even if properly SWIPed, ought not to be sold, but that all traffic should be checked on the way out. It sounds

RE: Abuse procedures... Reality Checks

2007-04-09 Thread Chris L. Morrow
On Mon, 9 Apr 2007 [EMAIL PROTECTED] wrote: If they're properly SWIPed why punish the ISP for networks they don't even operate, that obviously belong to their business customers? How can you tell that they don't operate a network from SWIP records? Seems to me that lots of network

RE: Abuse procedures... Reality Checks

2007-04-09 Thread Frank Bulk
That's been my entire point. Network operators who properly SWIP don't get credit for going through the legwork by other networks that apply quasi-arbitrary bit masks to their blocks. As I said before, if you're going to block a /24, why not do it right and block *all* the IPs in their ASN?

RE: Abuse procedures... Reality Checks

2007-04-09 Thread Azinger, Marla
I have to disagree. SWIP is not meaningless. In my company some functions related to sending a SWIP are automated, but my company has people on staff who know that it is happening and what it means. And I talk with plenty of other companies that fall into the same boat. In short I find

Re: Abuse procedures... Reality Checks

2007-04-09 Thread Valdis . Kletnieks
On Mon, 09 Apr 2007 17:11:28 EDT, Azinger, Marla said: In my company some functions related to sending a SWIP are automated, but my company has people on staff who know that it is happening and what it means. Just because *your* site has enough clue to get it right doesn't mean that the

Re: Abuse procedures... Reality Checks

2007-04-09 Thread Chris Owen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Apr 9, 2007, at 3:41 PM, Pete Templin wrote: Chris Owen wrote: Well, well managed to me would mean that allocations from that / 20 were SWIPed or a rwhois server was running so that if any of

Re: Abuse procedures... Reality Checks

2007-04-09 Thread Douglas Otis
On Apr 8, 2007, at 9:03 PM, Paul Vixie wrote: [EMAIL PROTECTED] (Douglas Otis) writes: Good advise. For various reasons, a majority of IP addresses within a CIDR of any size being abusive is likely to cause the CIDR to be blocked. While a majority could be considered as being half

Re: Abuse procedures... Reality Checks

2007-04-09 Thread Christopher X. Candreva
On Mon, 9 Apr 2007, Paul Vixie wrote: than you're describing. for example, this weekend two /24's were hijacked and used for spam spew. as my receivebot started blackholing /32's, the Why do you think they were hijacked ? At least for your second block: 1 71.6.213.103 I've