At 08:07 AM 20-02-03 -0600, Alif The Terrible wrote:
On Thu, 20 Feb 2003, William Allen Simpson wrote:
Anybody have a pointer to scripts to map IP to AS?
Google is your friend ;-)
There are still 10K-20K hosts spewing M$SQL slammer/sapphire packets, and I'd like to start blocking routing to those irresponsible AS's that haven't blocked their miscreant customers.
Then you'd better reach over to all of your upstream routers and just pull the plug, since you are likely to see Sapphire packets from here on in, on a regular basis.
Better is to do the whois lookup and send pre-formatted e-mail about the infected server as people did after Code-Red. -Hank
Of course, if blocking "irresponsible isp's" is really your agenda, you'd better start blocking those with Code Red/Nimda, Slapper, etc...
Enjoy your private corner of the world, devoid of connectivity...
-- Yours, J.A. Terranson sysadmin@mfn.org