be specific, like "if you run X tools the payoff will be Y."
Yes. And where is the appropriate form for this?
there must be some operators' list somewhere.
> it doesn't seem like the sort of thing NANOG is for
yep. nanog is for whining about it, not doing/saying something actually
constructive with technical content.
</sarcasm>
speaking as a small provider, I can tell you that I find running snort
against my inbound traffic does reduce the cost of running an abuse desk.
I do catch offenders before I get abuse@ complaints, sometimes.
unfortunately snort does not really scale to a larger provider. and, to
the best of my poor knowledge, good open source tools to
black-hole/redirect botted users are not generally available.
universities have some that are good at campus and enterprise scale.
cymru and a few security researchers responded privately to my plea for
solid open source tool sets and refs. knowing the folk involved, maybe
we'll see some motion. patience is a virtue, within limits.
randy
