25 Jan
2023
25 Jan
'23
2:56 p.m.
Not to hijack, but related to blocking scans, I am part of a community project to block
bad actors via BGP. Currently we are advertising several thousand /32s detected doing SSH
attempts. More to come in the future but if anyone is interested check out
www.projectton.com<http://www.projectton.com> you can also do CC blocking via BGP
and BOGONS.
-Colin / VA6CCB
From: Tom Hayward via 44net <44net(a)mailman.ampr.org>
Reply-To: Tom Hayward <esarfl(a)gmail.com>
Date: Wednesday, January 25, 2023 at 1:46 PM
To: "44net(a)mailman.ampr.org" <44net(a)mailman.ampr.org>
Subject: [44net] Re: Request: Blocking censys-scanner.com scans on AMPR subnets
On Tue, Jan 24, 2023 at 1:51 PM Rob PE1CHL via 44net
<44net@mailman.ampr.org<mailto:44net@mailman.ampr.org>> wrote:
It is relatively easy to autoblock such scanners at a gateway due to the large address
space that we have, and its relatively sparse use.
Once you notice a lot of incoming traffic on unallocated subnets, you know it is from a
scanner.
We do this for HamWAN's (BGP-announced) address space. We have a couple
intentionally-dark IP addresses, and if the edge routers detect packets destined to these
addresses, the source gets blocked in the firewall.
Our reasoning is something I haven't seen addressed in this thread yet. Beyond the
edge routers, there are parts of the network that transmit on amateur radio. As control
operators of this network, we have an obligation to ensure that regulations are followed
as closely as possible. These scanners are traffic not initiated by an amateur radio
operator, so we try to block them from reaching the part of the network that uses radio.
Tom KD7LXL