Re: riswhoisdump.IPv4.gz riswhoisdump.IPv6.gz
Andrzej,
Are riswhoisdump.IPv4.gz and riswhoisdump.IPv6.gz available somewhere ?
yes, you can find them under http://www.ris.ripe.net/dumps/ Best Regards, -- Rene =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Rene Wilhelm RIPE Network Coordination Centre Email: wilhelm@ripe.net Amsterdam, the Netherlands Phone: +31 20 535 4417 Fax: +31 20 535 4445 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Rene Wilhelm wrote:
Are riswhoisdump.IPv4.gz and riswhoisdump.IPv6.gz available somewhere ?
yes, you can find them under http://www.ris.ripe.net/dumps/
Thanks for the info. What is ripe stance about using the data from dumps (IP to AS mapping) for spam fighting ? e.g. extra spamassassin penalty (or plain blocking) of messages from "bad ASes". Some people "push" blocking based on "conutry of origin". IMHO blocking based on "AS of origin" does not punish small good standard ISPes for "sins" of the big guys. It makes "AS blocking" much better option than "country blocking". -- Andrzej [en:Andrew] Adam Filip anfi@priv.onet.pl anfi@xl.wp.pl Home Page http://anfi.homeunix.net/ [ PageRank 6 ]
On Sun, 2004-09-19 at 20:11, Andrzej Adam Filip wrote:
Rene Wilhelm wrote:
Are riswhoisdump.IPv4.gz and riswhoisdump.IPv6.gz available somewhere ?
yes, you can find them under http://www.ris.ripe.net/dumps/
Thanks for the info.
What is ripe stance about using the data from dumps (IP to AS mapping) for spam fighting ? e.g. extra spamassassin penalty (or plain blocking) of messages from "bad ASes".
Some people "push" blocking based on "conutry of origin". IMHO blocking based on "AS of origin" does not punish small good standard ISPes for "sins" of the big guys. It makes "AS blocking" much better option than "country blocking".
What you do with your network with regards to filtering is up to you, it is your network, you will not be able to contact certain sites and vice versa. Nevertheless see http://www.cluecentral.net/rbl/ which contains already AS based, country based and a number of other nice mechanisms for your blocking pleasures. Also this question is probably meant for some spam list, try db-wg which comes quite close, not ripe-users ;) Greets, Jeroen
Andrzej,
Rene Wilhelm wrote:
Are riswhoisdump.IPv4.gz and riswhoisdump.IPv6.gz available somewhere ?
yes, you can find them under http://www.ris.ripe.net/dumps/
Thanks for the info.
What is ripe stance about using the data from dumps (IP to AS mapping) for spam fighting ? e.g. extra spamassassin penalty (or plain blocking) of messages from "bad ASes".
The RIPE NCC does not have an opinion on that. We collect the data and make it available as is. How you use the data, is up to you. Note that we do not give any guarantees about the correctness or suitability of the data. The non-formal answer: I'd be interested in seeing any results from using this data to set up filters, though this probably belongs on the anti-spam-WG list. I hope this answers your question, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ In a room with a window in the corner, I found truth. (Ian Curtis)
Henk Uijterwaal (RIPE NCC) wrote:
Rene Wilhelm wrote:
Are riswhoisdump.IPv4.gz and riswhoisdump.IPv6.gz available somewhere ?
yes, you can find them under http://www.ris.ripe.net/dumps/
Thanks for the info.
What is ripe stance about using the data from dumps (IP to AS mapping) for spam fighting ? e.g. extra spamassassin penalty (or plain blocking) of messages from "bad ASes".
The RIPE NCC does not have an opinion on that. We collect the data and make it available as is. How you use the data, is up to you. Note that we do not give any guarantees about the correctness or suitability of the data.
I have tried to avoid risking "you have misused our IP, stop it!" accusations. [ with/or without legal background :) ]
The non-formal answer: I'd be interested in seeing any results from using this data to set up filters, though this probably belongs on the anti-spam-WG list.
I would like to see myself "per AS penalties" generated by the genetic algorithm used to fine tune spamassassin rules.
I hope this answers your question,
I think it does. P.S. Below please find some statistic of per AS open relays numbers based on njabl.org data (njabl.org retests open relays after 90 days) and riswhois.ripe.net queries. It shows that 25% of open relays detected by njabl.org is hosted by 16 ASes. [ 10%->3; 20%->10; 30%->25; 40%->48; 50%->89; 60%->168] No ORs %ORs TOTAL AS 1 886 5.33% 5.33% AS4134 CHINANET-BACKBONE (CN) 2 403 2.43% 7.76% AS7132 CHINANET-BACKBONE (CN) 3 396 2.38% 10.14% AS7491 Pacific Internet Philippines ASN (PH) 4 344 2.07% 12.21% AS3462 HiNet (TW) 5 314 1.89% 14.10% AS4766 KT-NET (KR) 6 296 1.78% 15.88% AS4713 7 268 1.61% 17.49% AS4837 8 174 1.05% 18.54% AS4812 9 159 0.96% 19.50% AS3352 10 147 0.88% 20.38% AS7678 11 144 0.87% 21.25% AS209 12 143 0.86% 22.11% AS4732 13 141 0.85% 22.96% AS701 14 136 0.82% 23.78% AS6503 15 128 0.77% 24.55% AS2828 16 119 0.72% 25.26% AS3215 17 114 0.69% 25.95% AS3269 18 114 0.69% 26.64% AS3786 19 113 0.68% 27.32% AS2856 20 108 0.65% 27.97% AS8151 IMHO it shows that AS based policies have a chance to deliver useful results. -- Andrzej [en:Andrew] Adam Filip anfi@priv.onet.pl anfi@xl.wp.pl Home Page http://anfi.homeunix.net/ [ PageRank 6 ]
Hi,
Below please find some statistic of per AS open relays numbers based on njabl.org data (njabl.org retests open relays after 90 days) and riswhois.ripe.net queries. It shows that 25% of open relays detected by njabl.org is hosted by 16 ASes. [ 10%->3; 20%->10; 30%->25; 40%->48; 50%->89; 60%->168]
No ORs %ORs TOTAL AS 1 886 5.33% 5.33% AS4134 CHINANET-BACKBONE (CN) 2 403 2.43% 7.76% AS7132 CHINANET-BACKBONE (CN) 3 396 2.38% 10.14% AS7491 Pacific Internet Philippines ASN (PH) 4 344 2.07% 12.21% AS3462 HiNet (TW) 5 314 1.89% 14.10% AS4766 KT-NET (KR) 6 296 1.78% 15.88% AS4713 7 268 1.61% 17.49% AS4837 8 174 1.05% 18.54% AS4812 9 159 0.96% 19.50% AS3352 10 147 0.88% 20.38% AS7678 11 144 0.87% 21.25% AS209 12 143 0.86% 22.11% AS4732 13 141 0.85% 22.96% AS701 14 136 0.82% 23.78% AS6503 15 128 0.77% 24.55% AS2828 16 119 0.72% 25.26% AS3215 17 114 0.69% 25.95% AS3269 18 114 0.69% 26.64% AS3786 19 113 0.68% 27.32% AS2856 20 108 0.65% 27.97% AS8151
IMHO it shows that AS based policies have a chance to deliver useful results.
Yup, it probably does. But please take this to the anti-spam-wg, where it belongs. Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ In a room with a window in the corner, I found truth. (Ian Curtis)
participants (4)
-
Andrzej Adam Filip -
Henk Uijterwaal (RIPE NCC) -
Jeroen Massar -
Rene Wilhelm