Seeking provider that is understanding towards service fingerprinting and scanning of the internet.

TimboJones

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

What would need to be moderated is the question?

To not set 80% score for an IP that was only found doing ICMP echo-request (that didn't even trigger a single abuse complaint), see https://lowendtalk.com/discussion/comment/4489508/#Comment_4489508

Please don't confuse ICMP requests with fingerprinting. That's the difference from someone shouting "anyone home?" from the street and someone going around recording your door and window status. That ain't your fucking business unless invited.

Unfortunately, this doesn't work like so. You can't even know if sent ICMP echo-request had spoofed source IP address or not, same goes for any report based upon single packet without any challenge (like TCP handshake for example).

We might be talking about different things. How does a spoofed source packet receive useful response (the fingerprint)?

It doesn't. What I meant is that it is bad idea to ban/report IP address that could be spoofed.

What use case are you referring to?

Not a use case, someone could just specifically craft same packet to accuse someone of doing malicious activity while they don't actually do it.

It's kind of on the side receiving the abuse report to validate and take action.

While I agree with this, I still stand still that you must not act upon unreliable evidence (one that easily forged).

It's to incentivise network operators to implement proper security like BCP38.

tentor

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

What would need to be moderated is the question?

To not set 80% score for an IP that was only found doing ICMP echo-request (that didn't even trigger a single abuse complaint), see https://lowendtalk.com/discussion/comment/4489508/#Comment_4489508

Please don't confuse ICMP requests with fingerprinting. That's the difference from someone shouting "anyone home?" from the street and someone going around recording your door and window status. That ain't your fucking business unless invited.

Unfortunately, this doesn't work like so. You can't even know if sent ICMP echo-request had spoofed source IP address or not, same goes for any report based upon single packet without any challenge (like TCP handshake for example).

We might be talking about different things. How does a spoofed source packet receive useful response (the fingerprint)?

It doesn't. What I meant is that it is bad idea to ban/report IP address that could be spoofed.

What use case are you referring to?

Not a use case, someone could just specifically craft same packet to accuse someone of doing malicious activity while they don't actually do it.

It's kind of on the side receiving the abuse report to validate and take action.

While I agree with this, I still stand still that you must not act upon unreliable evidence (one that easily forged).

It's to incentivise network operators to implement proper security like BCP38.

More like to annoy ones who implemented and deceive clueless

fluffernutter

@avsisp said:
Every state is different on this - and I'm no lawyer so not gonna try to quote all. I've only lived in 10 of them before leaving the USA.

offtopic, but why would you leave the US for Albania? genuinely curious.

TimboJones

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

What would need to be moderated is the question?

To not set 80% score for an IP that was only found doing ICMP echo-request (that didn't even trigger a single abuse complaint), see https://lowendtalk.com/discussion/comment/4489508/#Comment_4489508

Please don't confuse ICMP requests with fingerprinting. That's the difference from someone shouting "anyone home?" from the street and someone going around recording your door and window status. That ain't your fucking business unless invited.

Unfortunately, this doesn't work like so. You can't even know if sent ICMP echo-request had spoofed source IP address or not, same goes for any report based upon single packet without any challenge (like TCP handshake for example).

We might be talking about different things. How does a spoofed source packet receive useful response (the fingerprint)?

It doesn't. What I meant is that it is bad idea to ban/report IP address that could be spoofed.

What use case are you referring to?

Not a use case, someone could just specifically craft same packet to accuse someone of doing malicious activity while they don't actually do it.

It's kind of on the side receiving the abuse report to validate and take action.

While I agree with this, I still stand still that you must not act upon unreliable evidence (one that easily forged).

It's to incentivise network operators to implement proper security like BCP38.

More like to annoy ones who implemented and deceive clueless

What? Having the filtering in place allows you to confirm spoofing or not. "Hey, don't block us, it ain't coming from our network, we use egress filtering. Why don't you implement ingress filtering for your customers and reduce such issues."

tentor

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

@TimboJones said:

@tentor said:

What would need to be moderated is the question?

To not set 80% score for an IP that was only found doing ICMP echo-request (that didn't even trigger a single abuse complaint), see https://lowendtalk.com/discussion/comment/4489508/#Comment_4489508

Please don't confuse ICMP requests with fingerprinting. That's the difference from someone shouting "anyone home?" from the street and someone going around recording your door and window status. That ain't your fucking business unless invited.

Unfortunately, this doesn't work like so. You can't even know if sent ICMP echo-request had spoofed source IP address or not, same goes for any report based upon single packet without any challenge (like TCP handshake for example).

We might be talking about different things. How does a spoofed source packet receive useful response (the fingerprint)?

It doesn't. What I meant is that it is bad idea to ban/report IP address that could be spoofed.

What use case are you referring to?

Not a use case, someone could just specifically craft same packet to accuse someone of doing malicious activity while they don't actually do it.

It's kind of on the side receiving the abuse report to validate and take action.

While I agree with this, I still stand still that you must not act upon unreliable evidence (one that easily forged).

It's to incentivise network operators to implement proper security like BCP38.

More like to annoy ones who implemented and deceive clueless

What? Having the filtering in place allows you to confirm spoofing or not.

It needs to be implemented at the side of spoofing network, not victim or abused reporter. Otherwise, no effect.

"Hey, don't block us, it ain't coming from our network, we use egress filtering. Why don't you implement ingress filtering for your customers and reduce such issues."

We tried to explain that to @avsisp above. As you can see, it doesn't work in practice. In the result, AbuseIPDB is still spammed with junk and source IP spoofing is still a thing.

iceman

@fluffernutter said:

@avsisp said:
Every state is different on this - and I'm no lawyer so not gonna try to quote all. I've only lived in 10 of them before leaving the USA.

offtopic, but why would you leave the US for Albania? genuinely curious.

They don't usually, except if they got caught with criminal activities as they usually do! An albanian with a company "registered" in Wyoming, USA, i mean what could go wrong If you aren't in the US anymore, why did you registered a company in Wyoming then, tax evasion?