Botnet hunting resources (was: Re: DOS in progress ?)
goemon at anime.net
goemon at anime.net
Sun Aug 9 04:39:02 UTC 2009
On Fri, 8 Aug 2009, Luke S Crawford wrote:
> 1. are there people who apply pressure to ISPs to get them to shut down
> botnets, like maps did for spam?
sadly no.
> I've got 50 gigs of packet captures, and have been going through with
> perl to detect IPs who send me lots of tcp packets with 0 payloads, then
> manually sending abuse reports.
>
> Half the abuse reports bounce, and the other half are ignored.
> (most of the hosts in question are in china.)
it's a big problem, especially with rogue networks like france and china.
there is currently zero incentive for anyone clean up, as there are no
consequences for not doing so.
this will not change until there are real consequences for operating IP
cesspools.
-Dan
More information about the NANOG
mailing list