Why does abuse handling take so long ?

Mon Mar 14 16:35:00 UTC 2011

In a message written on Mon, Mar 14, 2011 at 12:11:54PM -0400, William Allen Simpson wrote:
> Leo's remembering the old days (80s - early '90s), when we checked whois and
> called each others' NOCs directly.  That stopped working, and we started 
> getting
> front line support, who's whole purpose was to filter.  Nowadays, I've often
> been stuck in voice prompt or voice mail hell, unable to get anybody on the
> phone, and cannot get any response from email, either.  Ever.  The big ILECs
> are the worst.

If you're a network operator, you probably know much better resources
for getting phone numbers.  That's not to say I wouldn't like to
see ARIN records cleaned up, I fought that battle for a number of
years.

INOC DBA?  Peeringdb.com?  puck.nether.net/netops?

I hate to say it, but if you're calling the number in Whois or on
the front off www.foo.com then perhaps frontline support is exactly
who you should be talking to about these issues.  The entire purpose
of any support organization is to filter to the appropriate folks.
The more clue you show in directing your query, the more clue you'll get
in response.

Also, it can help if you follow the relationships.  Consider two
"regional" networks and two "international backbone providers", so
you have a network path like:

R1----ISP1----ISP2----R2

I understand we'd all like it to work that if R1 needs to reach R2
they call them directly.  However sometimes calling ISP1 and making
them get involved allows them to get the attention of ISP2, and
finally them to get R2 to do something.

I can't think of a time I wasn't able to get ahold of the right
folks when I needed to do so, using publically available information.
But then I don't bother people about a few spams, or 1Mbps "DDOS's",
remain calm when I call, provide lots of information, and have a
realistic expectation of how quickly they might be able to respond.

Having answered abuse phones off and on for many years I can tell you
that's the exception, not the rule.  More common is to get someone
calling to scream at you for 15 minutes about how you're destroying
his livelyhood only to figure out that his box was misconfigured.
Funny how you never even get an "I'm sorry" when that happens.

-- 
       Leo Bicknell - bicknell at ufp.org - CCIE 3440
        PGP keys at http://www.ufp.org/~bicknell/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 826 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20110314/795b37c9/attachment.sig>