Frank Gadegast <ripe-anti-spam-wg@powerweb.de> writes:
Dont get the point here.
Obviously you don't.
If you get attacked with a whatever flood, you see the sender IP.
You see the IP that the sender has configured. To spell it out just for you: If someone configures a box to use the address 62.67.229.200 and then flood pings some poor soul using that address as source, who will then get all the abuse mails you want people to force to read? Hint: $ dig +noall +answer www.powerweb.de any www.powerweb.de. 500 IN MX 200 mail.berlin3.powerweb.de. www.powerweb.de. 500 IN MX 100 mail.powerweb.de. www.powerweb.de. 500 IN A 62.67.229.200 Now do that with an entire botnet and see what happens. Or do you have any plans you didn't share yet on how to prevent attackers from using this for a new kind of Joe job?
Your entire chain of reasoning relies on the fact that whatever IP address from an attacker your end users find in their logs identifies the abuse-c to contact.
Sure, end user arent normally able to find the IP, but there are already tools and plugins to do this.
So, more mails to abuse@powerweb.de. Which of course, since you want to force other people to read their abuse-c mail address, you will all read yourself. And if that's not enough to keep you busy: Maybe somebody with basic scripting skills takes your approach even a bit further and links his/her packet filter to script that stuffs every such packet in a mail to the "responsible" abuse-c. Happy reading.
And I still think that a central whois makes it easy to find the right contact, for end users, semi-professionals and pros ...
And the "right contact" is whoever holds the IP address used as source for some sort of attack or whatever. This is so immensely clever I'm absolutely speechless. -- Business Grade IPv6 Consulting, Training, Projects Benedikt Stockebrand, Dipl.-Inform. http://www.stepladder-it.com/