North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Smurf amp notification script?

  • From: Bruce Campbell
  • Date: Sat Mar 13 02:24:44 1999 
On Thu, 11 Mar 1999, Jeff Weisberg wrote:

> | > Does anyone have a script that takes a list of IP addresses, looks
> | > them up in whois, and mails the contact for them and tells them
> | > they're a smurf amp (with appropriate pointers to self-help files,
> | > etc)?
> The enclosed hack worked last time I tried it (but no garuntees).
> Change occurances of OpNet/op.net to your own name.
> #!/usr/local/bin/perl
[snip]
>     open(W, "whois -h whois.arin.net $net |");

Ok, that does fine for machines whose authoritive whois record is within
the ARIN whois database, but what about the other two thirds of the globe,
namely RIPE (Europe) and APNIC (Asia-Pacific) ?  Congratulations, you've
just emailed either '[email protected]' or '[email protected]' blaming one of
the IP registries for running (in this case) a smurf amplifier.

Please, go and track down the ipw script, its better than nothing as it
does have some knowledge of which whois server to query.  That way, you
won't get the ever-so-nicely worded response which basically says 'Ahem. 
Go query our whois server for the *correct* information.'.

--==--
Bruce.