Scanning (was Re: Stealth Blocking)

William Allen Simpson wsimpson at
Sun May 27 02:15:24 UTC 2001

We also were blocked by automated scanning from ORBS, about two years
ago.  I haven't ever checked to see whether the block was ever removed, 
since we made the decision that ORBS was the problem, and blocked ORBS

"Greg A. Woods" wrote:
> Do you have the mailer logs from those hosts?
After two years?  Certainly not!  Ever since the FBI investigation of 
one of our users, we dispose of the logs in days!  They cannot request 
what we do not keep.

> Can you prove that there was no other unauthorised use of them during
> the time *before* they were tested by ORBS?
How exactly does anyone prove a negative?

Nobody could assert that we have ever been technically unaware.  We had 
outside relaying blocked.  We had a formal AUP since inception (1994), 
long before any of the johnny-come-latelies.  We also used MAPS as soon 
as our software supported it. 

However, the reason ORBS cited at the time was that the server software
(Stalker SIMS) allowed the % hack.  I dunno why the % hack is a 
terrible problem -- support was _required_ in the olden days.  But, it 
was obsolete.  I believe that Stalker has since removed that feature.

In short, methinks you protesteth too much.

More information about the NANOG mailing list