Reporting abuse originating from JANET
Which IP addresses are JANET?
If you can identify from routing information
the Autonomous System number of the IP address concerned,
JANET is AS786 and this is a clear indication that we are
responsible.
Otherwise, almost all JANET addresses are recorded in the
RIPE Regional Internet Registry,
with routes or other infomation linking them to JANET.
-
Web lookup at
http://www.ripe.net/;
-
or if you have a whois program:
whois -h whois.ripe.net <IP address>.
Which domains are JANET?
There is no simple way to tell,
but most domains in ac.uk.
and all domains in ja.net.
belong to JANET organisations.
What to include in your report
Please include as much as possible of the following:
-
source IP address in JANET;
-
destination IP address (yours);
-
destination TCP or UDP port
(unless it is obvious, eg for Web or e-mail abuse);
-
date and time when the abuse started and finished
(include your timezone and check whether your system clock
was accurate at the time);
-
number of events
(packets, addresses scanned, mail messages, connection attempts etc);
-
brief statement of the problem;
-
any original log or trace information
(for e-mail abuse include the complete message header);
-
any other information you think may be helpful.
Often a good sample of log information or a complete
e-mail message header
is all that is needed.
Please do not send:
-
RIPE or other whois information for the JANET IP address
(we already know that);
-
traceroute information for the JANET IP address;
-
actual or implied threats;
-
blocks of standard text conveying no information
(often added by automated reporting scripts).
It is easiest for us if your e-mail report
is in plain text without HTML or attachments.
Our working language is English.
Where to send your report
If possible please send e-mail
to JANET CSIRT
at
irt@csirt.ja.net.
For other ways to contact JANET CSIRT see
Contacting JANET CSIRT.
What happens next
JANET CSIRT will examine your report and
send you an acknowledgment with a ticket number
of the form
[JANET CSIRT#987654]
in the message Subject:
and in the body of the message.
If you need to reply or to send us any update,
please leave the ticket reference unchanged
in the Subject:.
If it appears that a JANET organisation should take action
to stop the abuse you report,
we will work with them as necessary.
Normally we will not report to you on the progress of that work,
but if the abuse continues or you are uncertain what is going on
you are welcome to write to us again,
preferably using the ticket number we sent earlier.
