<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
mucking with DNS sets a bad precedent.<br>
Many of the arguments against dns based block lists (great firewall
of conroy) were based on dns blocking would slow things down etc.<br>
<br>
I think law changes or AUP changes allowing or perhaps mandating
infected computers be "quarantined" would be a much better root
causes fix.<br>
<br>
You don't need to be a jerk about it, emails, click through
warnings, and eventually quarantine over the course of a month would
suffice. <br>
From the POV of the service provider it makes sense to me, botnet
traffic costs everybody money the customer and the carrier and
detecting it wouldn't be too arduous.<br>
You don't need deep packet inspection on every packet traversing
your network. A few heuristics to identify candidates (spikes in
traffic etc) a little packet capture and monitoring of those for
suspicious traffic. Pretty much the same as the banks with CC fraud.<br>
<br>
I spose it might scare people about the privacy implications though.<br>
<br>
On 14/06/12 16:54, Martin - StudioCoast wrote:
<blockquote cite="mid:4FD98ABA.3070903@studiocoast.com.au"
type="cite">
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a moz-do-not-send="true"
href="http://www.computerworld.com.au/article/427613/telstra_trial_detects_5_4_per_cent_botnet_infection_rate/#closeme">http://www.computerworld.com.au/article/427613/telstra_trial_detects_5_4_per_cent_botnet_infection_rate/</a><br>
<br>
Surely contacting the domain registrars to get these domains taken
down is a better approach than altering dns records at the ISP
end.<br>
I guess this leads to a question to all network operators of
Australian ISPs, do you modify DNS records in your cache and if so
what for?<br>
<br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
<br>
</body>
</html>