[OZAPRS] Re: 202 Subnet

[Chris Hill]

Hi Alex,

If you've blocked outbound access to 202.x.x.x, then you might find some
difficulty in browsing to http://vk6.aprs.net.au as it's current IP
address
is 202.72.178.103

A significant number of Australian businesses are on 202.x.x.x addresses
too...

What I personally do, is regularly (once per hour) pull down the list of
the
top 20 source IP addresses for reported network attacks, and then
dynamically update my firewall to DENY inbound traffic from those subnets.

The list is available at http://isc.sans.org/top10.php and is easily
"grepped" and "cut" into shape.

If you want to know the owner of an IP address, just use whois.  For
example, the 202 address that started this all (202.12.147.52) belongs to
Telstra.  See http://www.samspade.org/t/ipwhois?a=202.12.147.52 
It also _appears_ to be in Melbourne.


73



Chris
vk6kch


-----Original Message-----
From: ozaprs-bounces at marconi.ics.mq.edu.au
[mailto:ozaprs-bounces at marconi.ics.mq.edu.au] On Behalf Of Alex Colquitt
Sent: Wednesday, 27 April 2005 12:22 PM
To: ozaprs at marconi.ics.mq.edu.au
Subject: [OZAPRS] Re: 202 Subnet

Yep, 202 covers India too. I've just blocked the whole subnet at my 
firewall.
They generate most of the net traffic in these parts.

Alex -VK1AC

ozaprs-request at marconi.ics.mq.edu.au wrote:

>Message: 2
>Date: Wed, 27 Apr 2005 11:49:08 +1000
>From: Hamish Moffatt <hamish at cloud.net.au>
>Subject: Re: [OZAPRS] Web pages down?....
>To: ozaprs at marconi.ics.mq.edu.au
>Message-ID: <20050427014908.GB26776 at cloud.net.au>
>Content-Type: text/plain; charset=us-ascii
>
>
>202.* covers all of Asia just about..
>
>73
>
>Hamish
>  
>
>
_______________________________________________
ozaprs mailing list
ozaprs at marconi.ics.mq.edu.au
http://marconi.ics.mq.edu.au/cgi-bin/mailman/listinfo/ozaprs


_______________________________________________
ozaprs mailing list
ozaprs at marconi.ics.mq.edu.au
http://marconi.ics.mq.edu.au/cgi-bin/mailman/listinfo/ozaprs