Home page logo
/

nanog logo nanog mailing list archives

Re: scripts to map IP to AS?
From: "Johannes Ullrich" <jullrich () euclidian com>
Date: Thu, 20 Feb 2003 09:41:09 -0500



There are still 10K-20K hosts spewing M$SQL slammer/sapphire packets, 
and I'd like to start blocking routing to those irresponsible AS's 
that haven't blocked their miscreant customers.

Its too early for such harsh measures. Unless you can live without 
most major consumer ISPs.

I don't have the AS data handy. but here a quick list of the top 20
domains with number of Sapphire infected hosts:


    948 uu.net   ( 943 of which are 'da.uu.net' )
    796 attbi.com   ( 501 are client.attbi.com. 295 client2.attbi.com. )
    490 qwest.net   ( 488 are da.qwest.net )
    445 att.net     ( 438 are dial-access.att.net)
    416 rr.com
    408 btopenworld.com
    395 rasserver.net
    376 comcast.net
    333 ipt.aol.com
    304 com.br
    279 pacbell.net
    272 tpnet.pl
    267 dsl-verizon.net
    259 net.au
    253 ttd.es
    243 cable.rogers.com
    224 mindspring.com  (152 are dialup.mindspring.com)
    220 dyn.optonline.net
    217 net.br
    205 ne.jp



http://isc.sans.org/port_details.html?port=1434
-- 
William Allen Simpson
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32



-- 
--------------------------------------------------------------------
jullrich () euclidian com             Collaborative Intrusion Detection
                                         join http://www.dshield.org


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault