Re: [marf] draft-jdfalk-marf-as

["John Levine" <[e-mail]>]

>I don't believe that there's sufficient implementation experience for
>an AS on non-solicited feedback, but I could be wrong.

I've been sending all of my abuse reports in ARF format for several
years.  I get the target addresses by a combination of looking up rDNS
in abuse.net and a largish local table of IP address ranges->domains.
It works reasonably well, at least as well as sending messages just
pasted in as text.  I used to get a lot of responses that said "we're
too scared and/or incompetent to open your attachment so send it
pasted in", but I haven't gotten any of those in a while.

My experience, which may or may not be typical of what other people
would find, is that sending reports in ARF format works fine, but
figuring out where to send them is a big challenge.  In particular,
getting the addresses from WHOIS works poorly both because of the iffy
quality of WHOIS data, and because WHOIS servers don't have the
capacity to handle high volume scraping.

R's,
John