As an official representative* of the U.S. Department of Bad Analogies, I am here to help. When I'm on a freeway, I expect to see a lot of cars, and I expect a small number of them to be driven by idiots. I wear my seat belt and try to be aware of the idiots to make sure I keep my distance. But I don't let them distract me from my primary task. I also see, very rarely, someone truly dangerous, perhaps a drunk, or a truck that is unknowingly losing cargo on the road. Those very few are worth making note of and pointing out to The Proper Authorities. At home, living at the end of a cul-de-sac, I expect to see very few cars, and I expect to be familiar with the drivers of most of them. When I see one that doesn't look familiar, I will probably notice it. If I see the same car more than once, I would probably say hello to the driver, and determine why he's there. The few times I've done this, I've usually found that they're a contractor, or someone visiting a relative. Once I've done so, I'll go back to something productive like watching The Simpsons. Yes, I could make a stink about them parking on the street, but it would make my neighbors think I'm far more grumpy and weird than they already think, and they'll be less inclined to lend me a hand next time I need to move something heavy. Moral of the story: Things that are alarming in one context are harmless in another, and vice versa. The value is in that SJDLR ("something just don't look right") instinct that cops and similar professions, that allows them to spot trouble. *I'm lying, of course. I don't even claim to represent my own opinion, never mind anyone else's.

-----Original Message----- From: Matt Levine [mailto:matt@deliver3.com] Sent: Friday, October 26, 2001 2:43 PM To: Simon Lockhart; Dan Hollis Cc: Christopher Wawak; Alex Rubenstein; nanog@nanog.org Subject: RE: EXAMPLE: ### xxx Canada detected a penetration attempt from 209.123.x.229. Incident# xxxx

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Wouldn't it be more appropriate to use "businesses" instead of houses? Trying the front door to a business to see if they're open (while no excuse for checking the windows, obviously) is a little more appropriate IMO..

Matt

- -- Matt Levine @Home: matt@deliver3.com @Work: matt@eldosales.com ICQ : 17080004 PGP : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x6C0D04CF "The Trouble with doing anything right the first time is that nobody appreciates how difficult it was."

- -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Simon Lockhart Sent: Friday, October 26, 2001 3:19 PM To: Dan Hollis Cc: Christopher Wawak; Alex Rubenstein; nanog@nanog.org Subject: Re: EXAMPLE: ### xxx Canada detected a penetration attempt from 209.123.x.229. Incident# xxxx

...

On Fri, 26 Oct 2001, Christopher Wawak wrote:

...

Well, not exactly. Looking into the windows or checking the doorknobs is more akin to looking at your directory structre on your computer or file ... Scanning is more like going through the phone book or looking at the names on mailboxes in a neighborhood....

So you dont mind if people portscan your network?

Stupid analogy # 54325235:

pinging all hosts on a net: Walking down a street finding out which houses exist

Portscan: Trying the doors, windows, etc on a house

I know which one I don't mind...

Simon - -- Simon Lockhart | Tel: +44 (0)1737 839676 Internet Engineering Manager | Fax: +44 (0)1737 839516 BBC Internet Services | Email: Simon.Lockhart@bbc.co.uk Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

-----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBO9m8rsp0j1NsDQTPEQKtSwCfdo8BpdgJoUZ5kJlvptNB14UwTLgAn0yy G6u7HTmDnKp9fAmJontSwdsd =LpNH -----END PGP SIGNATURE-----