nanog mailing list archives
Re: Smurf amp notification script?
From: Bruce Campbell <bc () vicious dropbear id au>
Date: Sat, 13 Mar 1999 17:18:35 +1000 (EST)
On Thu, 11 Mar 1999, Jeff Weisberg wrote:
| > Does anyone have a script that takes a list of IP addresses, looks | > them up in whois, and mails the contact for them and tells them | > they're a smurf amp (with appropriate pointers to self-help files, | > etc)? The enclosed hack worked last time I tried it (but no garuntees). Change occurances of OpNet/op.net to your own name. #!/usr/local/bin/perl
[snip]
open(W, "whois -h whois.arin.net $net |");
Ok, that does fine for machines whose authoritive whois record is within the ARIN whois database, but what about the other two thirds of the globe, namely RIPE (Europe) and APNIC (Asia-Pacific) ? Congratulations, you've just emailed either 'nicdb () ripe net' or 'sysadm () apnic net' blaming one of the IP registries for running (in this case) a smurf amplifier. Please, go and track down the ipw script, its better than nothing as it does have some knowledge of which whois server to query. That way, you won't get the ever-so-nicely worded response which basically says 'Ahem. Go query our whois server for the *correct* information.'. --==-- Bruce.
Current thread:
- Smurf amp notification script? Stephen Sprunk (Mar 11)
- Re: Smurf amp notification script? Troy Davis (Mar 11)
- <Possible follow-ups>
- Re: Smurf amp notification script? Jeff Weisberg (Mar 11)
- Re: Smurf amp notification script? Bruce Campbell (Mar 12)