Abuse procedures... Reality Checks

Mon Apr 9 22:04:09 UTC 2007

On Apr 8, 2007, at 9:03 PM, Paul Vixie wrote:
> dotis at mail-abuse.org (Douglas Otis) writes:
>
>> Good advise.  For various reasons, a majority of IP addresses  
>> within a CIDR of any size being abusive is likely to cause the  
>> CIDR to be blocked. While a majority could be considered as being  
>> half right, the existence of the "bad neighborhood" demonstrates a  
>> lack of oversight for the entire CIDR, which is also fairly  
>> predictive of future abuse.
>
> that sounds like a continuum, but my experience requires more  
> dimensions than you're describing.  for example, this weekend two / 
> 24's were hijacked and used for spam spew.

Agreed.

This was expressed recently as well.

http://www.merit.edu/mail.archives/nanog/msg05351.html

CIDRs should also conform with ASN boundaries and reputation tracks  
with announcements.

Unfortunately an effort to create a black-hole operator's BCP failed  
to consider these issues.  Many building their own reputation  
histories will also likely ignore this concern.  This means John's  
advice remains valid, whether fair or not.  Adopting transient  
tracking methods cope with this problem.

-Doug