Richard Cox wrote:
RIPE has no role to punish network abusers. RIPE should have a role to take appropriate action against those who abuse RIPE's resources. That would include providing false identity or configuration details in connection with a request for network resources. Those are the cases where revocation of those resources is needed - and of course the routing data would then have to be removed as a result.
And there we are again. If we do not extend RIPEs responsibility and the RIPE regulations so that the members are responsible for using RIPE resources without abuse and RIPE NCC has therefor no responsibility to monitor abuse, there will be no revocation. And because we will never have a definition of abuse, there will be no change in the regulations and no demand to RIPE NCC handle this. Conclusion: because RIPEs members are not willing to take responsibility and abuse will continue forever. And we only can work here to make protection easier for those, who want to do something for themselv. But thats only a cure, not a solution ...
What is worth bearing in mind is that a revoked allocation should show up in IP-WHOIS as REVOKED for a given period of time after revocation. Otherwise we get the vexing situation where an abuser asks an ISP to route his IP block and tells the ISP, when they check RIPE's WHOIS and see "not found", "Oh dear, looks like the RIPE database isn't working.
"Revoked" must be clearly visible. For example, nobody really knows
Good idea.
why AS43074 and 193.109.246.0/23 are no longer in the RIPE database. But AS43074 (announcing 193.109.246.0/23) is being routed by STARNET
Well, thats clearly a mistake of STARNET then. You should talk to them, if STARNET is one of your upstream providers. The should really filter there routes against route objects. None, of our upstream providers does route this network.
in Moldova and bringing you all the lovely Zeus malware and similar.
Network Next Hop Path *> 193.109.246.0/23 208.74.64.40 3257 31252 43074 i
Unfortunately removing rDNS etc won't stop that malware spreading.
True, but revocation of route objects does. Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank@powerweb.de