Re: Why does abuse handling take so long ?

2011-03-14 Thread William Allen Simpson
On 3/13/11 9:35 PM, goe...@anime.net wrote: the real cesspool is POC registries. i wish arin would start revoking allocations for entities with invalid POCs. Hear, hear! Leo's remembering the old days (80s - early '90s), when we checked whois and called each others' NOCs directly. That

Re: Why does abuse handling take so long ?

2011-03-14 Thread Leo Bicknell
In a message written on Mon, Mar 14, 2011 at 12:11:54PM -0400, William Allen Simpson wrote: Leo's remembering the old days (80s - early '90s), when we checked whois and called each others' NOCs directly. That stopped working, and we started getting front line support, who's whole purpose

Re: Why does abuse handling take so long ?

2011-03-14 Thread David Miller
On 3/14/2011 12:11 PM, William Allen Simpson wrote: On 3/13/11 9:35 PM, goe...@anime.net wrote: the real cesspool is POC registries. i wish arin would start revoking allocations for entities with invalid POCs. Hear, hear! Leo's remembering the old days (80s - early '90s), when we checked

Re: Why does abuse handling take so long ?

2011-03-14 Thread J. Oquendo
On 3/13/2011 7:45 AM, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? They really do take this serious as it cuts into productivity. Proof they care:

Re: Why does abuse handling take so long ?

2011-03-14 Thread Valdis . Kletnieks
On Mon, 14 Mar 2011 12:35:27 EDT, David Miller said: Define contacts don't work properly. - Email / phone number does not exist? - Email / phone was answered by unhelpful person? Somewhere between these two should be email/phone number exists, but is completely unable to serve the function

Re: Why does abuse handling take so long ?

2011-03-14 Thread Jason Bertoch
On 3/14/2011 2:13 PM, valdis.kletni...@vt.edu wrote: On Mon, 14 Mar 2011 12:35:27 EDT, David Miller said: Define contacts don't work properly. - Email / phone number does not exist? - Email / phone was answered by unhelpful person? Somewhere between these two should be email/phone number

Re: Why does abuse handling take so long ?

2011-03-14 Thread Douglas Otis
On 3/14/11 9:11 AM, William Allen Simpson wrote: On 3/13/11 9:35 PM, goe...@anime.net wrote: the real cesspool is POC registries. i wish arin would start revoking allocations for entities with invalid POCs. Hear, hear! Leo's remembering the old days (80s - early '90s), when we checked

Why does abuse handling take so long ?

2011-03-13 Thread Alexander Maassen
Dear nanog members, As current maintainer of DroneBL I happen to receive a lot of unwanted packets in the form of DDoS attacks, now the DDoS itself is not the real problem, dealing with it the fast way is. Now most of you would think: Just filter it, put a big firewall in front of it, bla bla

Re: Why does abuse handling take so long ?

2011-03-13 Thread goemon
On Sun, 13 Mar 2011, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? they don't act like they do not care. they really *don't* care. no acting. 1) you're not a direct customer, why should they do anything? by

Re: Why does abuse handling take so long ?

2011-03-13 Thread sthaug
Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? they don't act like they do not care. they really *don't* care. no acting. Well now, I'd say this varies considerably. There are definitely ISPs that care and *do* work hard at reducing

Re: Why does abuse handling take so long ?

2011-03-13 Thread William Pitcock
On Sun, 13 Mar 2011 05:39:02 -0700 (PDT) goe...@anime.net wrote: On Sun, 13 Mar 2011, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? they don't act like they do not care. they really *don't* care. no acting.

Re: Why does abuse handling take so long ?

2011-03-13 Thread Florian Weimer
* Alexander Maassen: In most cases the only thing the abuse@ contacts do as hoster, is relay the mail to the client but do not dare to do anything themself, even if you provide them with a shitload of logs, even if you call them and say that the attack from their source is still continueing,

Re: Why does abuse handling take so long ?

2011-03-13 Thread Andrew Kirch
On 3/13/2011 8:39 AM, goe...@anime.net wrote: On Sun, 13 Mar 2011, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? they don't act like they do not care. they really *don't* care. no acting. 1) you're not a

Re: Why does abuse handling take so long ?

2011-03-13 Thread Jeff Wheeler
On Sun, Mar 13, 2011 at 7:45 AM, Alexander Maassen outsi...@scarynet.org wrote: In most cases the only thing the abuse@ contacts do as hoster, is relay the mail to the client but do not dare to do anything themself, even if The RIPE IRR database contains a systemic means for operators,

Re: Why does abuse handling take so long ?

2011-03-13 Thread Joel Jaeggli
On 3/13/11 8:36 AM, Andrew Kirch wrote: On 3/13/2011 8:39 AM, goe...@anime.net wrote: On Sun, 13 Mar 2011, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? they don't act like they do not care. they really *don't*

Re: Why does abuse handling take so long ?

2011-03-13 Thread William Allen Simpson
On 3/13/11 7:45 AM, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? Because network operators rarely get together and turn off routing to abusive hosting. On the few occasions that has happened, it took years of

Re: Why does abuse handling take so long ?

2011-03-13 Thread Brielle Bruns
On 3/13/11 7:02 AM, sth...@nethelp.no wrote: Well now, I'd say this varies considerably. There are definitely ISPs that care and*do* work hard at reducing abuse. But even so - assuming I'm an ISP that cares, - You're presenting me with evidence of abuse. OK, I don't know you. Why should I

Re: Why does abuse handling take so long ?

2011-03-13 Thread Andrew Kirch
On 3/13/2011 1:24 PM, Joel Jaeggli wrote: On 3/13/11 8:36 AM, Andrew Kirch wrote:= Is it time for another notion of self-defense in responding to/retaliating against a DDoS attack of sufficient strength to hold down a large network, or resource? Because there just aren't enough internet

Re: Why does abuse handling take so long ?

2011-03-13 Thread Florian Weimer
* Jeff Wheeler: On Sun, Mar 13, 2011 at 7:45 AM, Alexander Maassen outsi...@scarynet.org wrote: In most cases the only thing the abuse@ contacts do as hoster, is relay the mail to the client but do not dare to do anything themself, even if The RIPE IRR database contains a systemic means for

Re: Why does abuse handling take so long ?

2011-03-13 Thread Jeff Wheeler
On Sun, Mar 13, 2011 at 5:33 PM, Florian Weimer f...@deneb.enyo.de wrote: Not that the IRTs are often not the party you want to talk to anyway. This is why my post highlights the underlying mechanism/system. It can and should be used to streamline DDoS mitigation. It is unfortunately not in

Re: Why does abuse handling take so long ?

2011-03-13 Thread goemon
On Sun, 13 Mar 2011, Jeff Wheeler wrote: So ultimately, there is already a good framework in place to substantially fix this problem. No one uses it. That is unlikely to change until there is an economic incentive, such as a lawsuit by someone targeted by DoS which can be proven to be

Re: Why does abuse handling take so long ?

2011-03-13 Thread Alexander Maassen
On 13-3-2011 18:31, William Allen Simpson wrote: On 3/13/11 7:45 AM, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? So, part of the problem is *your* upstream. Why didn't your upstream actively remove the

Re: Why does abuse handling take so long ?

2011-03-13 Thread goemon
On Sun, 13 Mar 2011, Alexander Maassen wrote: On 13-3-2011 18:31, William Allen Simpson wrote: On 3/13/11 7:45 AM, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? So, part of the problem is *your* upstream. Why

Re: Why does abuse handling take so long ?

2011-03-13 Thread Larry Brower
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 03/13/2011 05:34 PM, goe...@anime.net wrote: On Sun, 13 Mar 2011, Alexander Maassen wrote: On 13-3-2011 18:31, William Allen Simpson wrote: On 3/13/11 7:45 AM, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing

Re: Why does abuse handling take so long ?

2011-03-13 Thread Leo Bicknell
In a message written on Sun, Mar 13, 2011 at 12:45:04PM +0100, Alexander Maassen wrote: Why o why are isp's and hosters so ignorant in dealing with such issues and act like they do not care? One of the things you have to remember is that ISP's get a ton of reports, and most of them are of very

Re: Why does abuse handling take so long ?

2011-03-13 Thread Alexander Maassen
Op 14-3-2011 0:21, Leo Bicknell schreef: Quite frankly, most ISP's aren't going to take your DDOS report seriously via e-mail. If it's not bad enough to you that it is worth your time and money to make a phone call and help them track it down it is not worth their time and money to track

Re: Why does abuse handling take so long ?

2011-03-13 Thread goemon
On Sun, 13 Mar 2011, Leo Bicknell wrote: Quite frankly, most ISP's aren't going to take your DDOS report seriously via e-mail. If it's not bad enough to you that it is worth your time and money to make a phone call and help them track it down it is not worth their time and money to track it

Re: Why does abuse handling take so long ?

2011-03-13 Thread Suresh Ramasubramanian
Depends on what you're yelling at them about and what you tell them. I've picked up the phone and had a NOC guy at a russian SP (can't remember which, Caravan I think) kill off a syn flood that was hitting us promptly, at like 1 AM their time. On Mon, Mar 14, 2011 at 7:05 AM, goe...@anime.net