Actions to quiet the Smurf amplifiers?

Mon Oct 19 21:16:50 UTC 1998

On Mon, Oct 19, 1998 at 12:03:41PM -0700, Dan Hollis put this into my mailbox:

> On Mon, 19 Oct 1998, Phil Howard wrote:
> > Dan Hollis wrote:
> > > The last site I dealt with took _3 weeks_ to close their amplifiers once
> > > they were notified. And this was a multimillion dollar publishing company.
> > Wow, you sure get them to act quickly!  How did you manage to get a big
> > monstrous behemoth like "corporate america" to move that fast?  :-)
> 
> They did nothing for two weeks, then their upstream threatened to pull
> their connection.

I've found that CC:'ing uplinks on the first e-mail to smurf amplifier
contacts works VERY WELL...I managed to get Santa Clara University (a
site notorious for being smurf amplifier that ignored all attempts to
get them to fix things) to fix their routers. Several others happily
shut off their amplifiers, as well.

When in doubt, add more addresses to the CC: line. I realize this ends
up annoying the more clueful folks who actually read e-mail to things
like abuse@, security@, noc@, etc, but unfortunately the less clued
folks (whose only 'administrative' type account is webmaster@, if they
even have that) seem to be more prevalent these days.

(What was even more hilarious about SCU.edu was that they had the gall
to mail me back saying this was the first they'd heard of the problem
 and that they had been working with their uplink to find out why their
connection was constantly at 90% utilization....)

-dalvenjah

-- 
 Dalvenjah FoxFire (aka Sven Nielsen)  I bet living in a nudist colony takes
 Founder, the DALnet IRC Network       all the fun out of Halloween.

 e-mail: dalvenjah at dal.net             WWW: http://www.dal.net/~dalvenjah/
 whois: SN90                           Try DALnet! http://www.dal.net/