Re: [ncc-services-wg] RIPE50 - NCC Services WG Draft Minutes

[Hank Nussbacher <]

> D. A New Version of the Hostcount
> http://www.ripe.net/ripe/meetings/ripe-50/presentations/ripe50-serv-
> hostcount.pdf
> RIPE NCC
>
> Timur requests feedback on the value of this service.
>
> Questions:
> Kurtis asks how many are using this whois data?  Counts...yes, a few
> people using this data.
> Anyone has any comments about proposed changes?

As someone who was not at RIPE50 but who uses hostcount, I would like to
add my comments and support.  I find this service extremely useful.  One
real world use is as follows: the university network in Israel has IP
addresses spanning a range of about 16 /16s.  All domain names inside the
universities should terminate with ac.il or at the worst org.il.  But
often students take a university Unix system that they have access to and
start using it for non-academic purposes (left as an exercise for the
reader to think of what constitutes non-academic :-)).  Using grep on the
raw data file I can easily spot those systems that are running
questionable content based on their domain name (co.il for example).

Sometimes, hackers change an IP address to some name that has certain
character strings that are unique to the hacker realm.  By running a
series of greps on the raw data file I can find those systems that may
have been compromised and contact the appropriate ISP in Israel.

So please - make hostcount work again.  Incidentally, it stopped working
in Jan 2005.

Regards,
Hank