[unisog] MediaSentry Copyright Infringement Notices
Peter Van Epp
vanepp at sfu.ca
Mon Apr 26 21:42:03 GMT 2004
On Mon, Apr 26, 2004 at 04:03:25PM -0400, Jeanne Smythe wrote:
> Over the last week we've received several infringement notices which
> cited ip addresses that have never been used on our network. Is anyone
> else seeing the same problem?
> Jeanne Smythe
> UNC Chapel Hill Copyright Agent
While we haven't seen any of these, there are three choices: someone on
your net is using illegal IPs to file share (unless your network blocks such
things in some manner) or (less likely because of reply issues) someone external
is spoofing addresses on your network or the complaining party is wrong.
Argus, netflow (or equivelent) on your border router or tcpdump on a machine
connected to your Internet link (none of which may be practical short term)
would be the only way to tell which is the case. If you see the traffic exiting
your network then you have a local problem to deal with (and hopefully the
source MAC address on your net that it came from), if you don't then someone is
spoofing or the complaintant is wrong neither of which is your problem since
you can demonstrate the traffic didn't originate on your network. Good luck!
Peter Van Epp / Operations and Technical Support
Simon Fraser University, Burnaby, B.C. Canada
More information about the unisog