[Dshield] Ping Problems

John Sage jsage at finchhaven.com
Mon Nov 4 15:12:41 GMT 2002


On Sun, Nov 03, 2002 at 11:44:24PM -0600, keithtarrant at spamcop.net wrote:
> Don't worry about him Jim.  To some people if it isn't illegal it is okay.
> And some people find implementing and monitoring computer security, new
> people, and the Internet, b o r i n g.

You really don't have to worry about me, true..

My point, not well expressed, is that this sort of stuff (distance
metrics, load balancing..) goes on all the time, and is very obviously
different from pings as precursors to malicious probing.

The expressed sentiment that: "..What kind of action can I take
against them..." I find unsettling.

Why do we always have to "take action against" something that is, in
fact, barely annoying?

The original poster has apparently notified them; perhaps they're
idiots. He knows what the pings are: nothing, really. My suggestion is
that he let it go and get on with more important matters.


> You could check the source IP on www.dshield.org and see if anyone else is
> getting pinged or probed by them.

Probably many people are: that's the entire apparent point to what
they're doing.

>From the original post:

"...I have this company that does internet performance monitoring..."

He knew what they were doing from the outset.

Why should the cessation of this benign activity _to his system(s) only_
(apparently he's not concerned that they are probably doing this to
many, many people..) be something that he insists take primary
priority in thier workload?

How much work would it be for them to exclude his netblock from their
performance monitoring program?

Are there actually users on his network who would benefit from the
accurate performance monitoring they are conducting?

Would it be a violation of the contracts they have signed with _their_
customers to unilaterally exclude IP ranges that their customers
_want_ to have monitored for performance?


All questions that imply this could be far more involved than the
original poster's irritation with something that is, once again,
really nothing to be upset about...



- John
-- 
Forest: a collection of trees

    PGP key: http://www.finchhaven.com/pages/gpg_pubkey.html
Fingerprint: C493 9F26 05A9 6497 9800  4EF6 5FC8 F23D 35A4 F705




More information about the list mailing list