[Dshield] What is "average" reply/fightback ratio?

Keith Bergen keith at keithbergen.com
Wed Jun 18 14:47:55 GMT 2003

I too was one of the respondents to the original post.

I too was not complaining. In fact, I was very elated to 
finally (back in Mid-April) find a service such as DShield. 
The time that I would have to spend researching each probe 
and connect personnaly would simply be time prohibitive, and 
not all that fun. It is nice to be able to contribute to a 
monitoring service such as DShield. Even if my fight backs 
are not responded, I still feel that I've done something in 
the way of informing the Internet in general of the problems.

Please do not take my posts as a complaint of DShield or the 
fight-back services. I have many things to complain about 
(ISP's, unsecure O/S's, etc) but DShield is definately not 
one of them.


---- Original message ----
>Date: Wed, 18 Jun 2003 07:06:11 -0700
>From: "Richard Roy" <RoyR at justicetrax.com>  
>Subject: RE: [Dshield] What is "average" reply/fightback 
>To: "General DShield Discussion List" <list at dshield.org>
>Amen to that Deb!
>I was not complaining in the slightest.  In fact, I tell 
everyone I know
>about Dshield.  Unfortunately I cannot link to it from the 
company web
>site, but I tell anyone who will listen about it.  Our 
company works
>with Law Enforcement agencies all over the globe.  I've 
helped several
>of them submit their home logs to the project, and am 
working to see if
>we can get some of their work logs submitted.  I applaud 
Johannes and
>co. for all the work they do.  I only wish I could get the 
funding to go
>to a seminar, take the courses and personally thanks them 
over a tall
>cool frosty beverage!
>As for fightback....it'd be nice to know that the problem 
has been
>fixed, but I care more that they actually try to fix it then 
spend time
>telling me they are.
>-----Original Message-----
>From: Deb Hale [mailto:haled at pionet.net] 
>Sent: Wednesday, June 18, 2003 6:31 AM
>To: 'General DShield Discussion List'
>Subject: RE: [Dshield] What is "average" reply/fightback 
>David - I didn't get the feeling that anyone was 
complaining.  I felt
>that it was simply a curious inquiry.  When I replied to the 
>email message it was simply to state that I have not seen 
any responses
>to any of the fightbacks that have been sent using my data.  
>I agree with some of what you state here.  I agree that the 
ISP's are
>not in the business to REPLY to anyone's complaints, 
however, I do HOPE
>that they at least look at the information that is being 
sent to them
>and act where appropriate.  Unfortunately,  I think more of 
them have
>your attitude about their responsiblility. They feel that it 
is not
>THEIR problem that some "stupid" home computer user has a
>virus/spyware/trojan, etc that is causing their computer to 
spit out
>garbage that does clog up their pipe.  As long as it doesn't
>significantly impact their bandwidth WHO CARES, right? The 
problem is
>that all of these little fellor's may be setting up to 
someday start a
>Ddos attack.  When that happens - their customers maybe down 
for hours
>and sometimes days. What will this do to their bottomline?  
When this
>happens - they lose revenue - sleep - and sanity!  Wouldn't 
it be a lot
>better for them if they stopped it before it gets that far?  
>Frankly, I don't care if they REPLY to the fightback as long 
as they
>RESPOND.  In other words, as long as they do something to 
fix the
>I am a huge fan of Dshield - I think Johannes and the rest 
of the staff
>at ISC, Dshield and SANS do an outstanding job.  I have no 
criticism of
>them whatsoever. If you look at my website you will see that 
I support
>the efforts of these folks.  I have the warning banner on my 
web - I
>have links to the maps, handler's incident, and both isc and 
dshield.  I
>am trying to educate the ISP's in this community as well as 
the small
>business and home computer users.  We can NOT expect anyone 
to fix
>something that they are not aware is "broke". You missed 
this very
>important point. 
>Dshield does help with early warnings. BUT what good is that 
going to do
>if all of the ISP's ignore the warnings? 
>This is my 2 cents.  I just wanted to show you perhaps a 
different point
>Deborah F Hale
>Certified Business Continuity Professional/Computer Security 
>BCP Enterprise, Inc
>Telephone: (712) 252-0361
>list mailing list
>list at dshield.org
>To change your subscription options (or unsubscribe), see: 

More information about the list mailing list