SORBS?!

Sat Apr 7 03:02:18 UTC 2012

On Fri, 06 Apr 2012 20:48:44 -0500, Jimmy Hess said:

> That's kind of vague to say it's "unlikely to see 1 abuser".   What is
> the probability that
> more IPs in the same /24  are likely to harbor abusers,  given that you have
> received abuse from one IP?

It's similar to pirhanas or cockroaches - they can't be found everywhere, but
if you spot one in a location, there's a near certainty that there's plent more
in the area.

Or if you don't like that, you can run a simple Monte Carlo simulation.  Assume
256 customer slots, and that initially, there is a 3% chance that the next
customer to arrive is evil. Also add a feedback - each time you terminate an
evil customer in less than the average arrival time, the chance the next
customer is evil is cut by 10% of the current value.   Each time an evil
customer is allowed to last 3 times the average arrival time, the chance of an
evil customer goes up 10%.  Simulate for various termination times for
evil customers.

Are there any steady-state solutions where the *average* number of evil
users is one? Or does it decay down towards zero or upwards towards
a high number?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 865 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20120406/5993b15c/attachment.sig>