On Fri, Nov 27, 2009 at 10:43 PM, ML <ml@kenweb.org> wrote:
I'm reasonable certain a customer of ours who is using one of our netblocks is using a different reverse path to reach us. How might I figure out who is allowing them to source traffic from IPs that belong to us?
Hi, Are they complaining about somehting? If so, ask for a traceroute. You might also try calling and asking. "We're seeing some strange traffic purporting to be from your addresses but not coming from your circuit. We're concerned that someone might be attacking your network. Before taking action to protect you, we want to eliminate the possibility that you have a second ISP through which you're accidentally sourcing the packets." Beyond that, what's your game plan once you know the answer? Threaten to cut them off? That's a great way to lose a customer who you know *already* has a second ISP. Maybe you'll call their second ISP and complain about their filtering practices? I'd love to get that call from you. Tells me exactly which name to pass to my upsell specialist. Yes Mr. Customer, your other ISP is trying to cut you off. They even asked us to block your packets. But for just a little more we'll give you IP addresses that you can use with any ISP. Regards, Bill Herrin -- William D. Herrin ................ herrin@dirtside.com bill@herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004