reporting port scaning abuse based on whois

From: JJB (Barbish3_at_adelphia.net)
Date: 05/19/04

  • Next message: dertakamine_at_sthi.com: "Out of Office" 
    To: "freebsd-questions@FreeBSD. ORG" <freebsd-questions@FreeBSD.ORG>
Date: Tue, 18 May 2004 18:04:20 -0400

    My ipfilter firewall is blocking 35 to 150 port scan packets per
    minute coming from all over the world. I have an dynamic IP address
    assigned by my ISP, so I know the senders are scanning an whole
    subnet range of IP address for the ports they are interested in. I
    have to pay for this background packet noise in bandwidth usage
    surcharges. I decided to research and try to build an process to
    report this abuse to the ISP's who own the source IP address that is
    scanning the whole subnet ranges of IP address I belong to.

    I pieced together an perl script from many other sources that reads
    the ipfilter ipmon log creating an structured file with the source
    and target ip address padded with zeros to sort the source ip
    address into sequence, then I read the sorted file and do an whois
    lookup on the source ip address and scan the whois output for an
    abuse@ domain name building an email including the log records as
    evidence and send it. This process only found abuse@ email address
    for about 30% of the abusive port scan traffic being blocked.
    Manually doing whois on some of the remainder, I see many different
    reporting abuse email address. I guess abuse@ is not an standard
    naming convention.

    An I going about this the correct way, or is there some other way I
    should be doing this?
    Is whois ip addr the only way to find the owner of the ip address
    block?

    Do any of the readers of this list have an perl script that does
    something like what I an trying to do, that they would share, or
    exchange in return for receiving an copy of mine?

    I am thinking about changing the way I search the whois output for
    abuse@, to scanning the output one position at an time for @ then
    parse left and right of it to first blank to capture email address,
    then save it in table and continue with scan looking for another
    email address. Then interrogate the harvested email address in the
    table for abuse, spam, tech or webmaster to choose best email
    address to send my reporting abuse email to. The problem is my perl
    coding ability is not sufficient to accomplish this. An sample scan
    routine sure would go a long way in enabling me to understand the
    coding technique so I could modify it to my purposes.

    Any comments or coding help sure would be helpful.

    Thanks

    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: dertakamine_at_sthi.com: "Out of Office"

    Relevant Pages

    • Re: Irritating DSL annoyance
      ... Your fw needs to _allow_ traffic in headed for its IP and port#. ... "Which whois _server_ are you ... you will get packets "directed" to your IP/ports. ... Even if it's just some "kids" playing around, ...
      (comp.os.linux.misc)
    • Abuse reporting based on whois
      ... an process to report this abuse to the ISP's who own the source IP ... then I read the sorted file and do an whois ... for about 30% of the abusive port scan traffic being blocked. ... nothing to report all the port targeted packet traffic. ...
      (freebsd-isp)
    • Repeated Port Scan
      ... I've been getting port scans from the same IP address for 3 days. ... When I do a whois on the address it doesn't give much information ... some of the packets that I've captured, ... Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ...
      (Security-Basics)
    • Re: Binding array to pattern
      ... always cut/paste real code here. ... SM> I'm extracting e-mail contacts from whois data. ... SM> the word "abuse" in the addresses or might have it only in the tags. ... there are perl6 modules on cpan which are written in perl5. ...
      (comp.lang.perl.misc)
    • Re: Deutsche-Telekom sets the standard for network security! (??)
      ... >> minded enough to take abuse reports seriously, ... I do call port scans an abuse. ... the IU's IT Security Office to engage in a wholesale ... Warning to commercial e-mailers: ...
      (comp.os.linux.security)