I'm being Joe-Jobbed from an NTL address

[Chris W]

Originally Posted by Matth

Dialup modems don't have a mac address - I guess the way they trace it is by the login - presumably the login for each IP address is recorded.

urm... am i wrong in thinking that every device that connects to the internet has a mac address??

I thought the dua worked in a similar way to the usb connection- the usb will create a mac address one character different to the cable modem it is connected to.

I may well be wrong though and yes i would assume, although i dont know that each login attempted is recorded.

MB

[Matth]

Every ETHERNET device has a MAC address, but dialup modems don't (do ADSL USB devices have a MAC address?).
NOW I'm baffled, my PPP adapter (the modem I'm not using) shows a MAC address in winipcfg - 44:45:53:54:00:00 - I suspect it may be faked by Windows.

In ADSL, I believe there IS an authentication - it seems to operate like a "Dialup networking" connection.

In NTL CABLE, you have your MAC address, and your typically 99% consistent IP address.

In NTL (or any other) dialup, authentication (probably wrong to call it log in) is performed, so they must have the capability to log which user an IP was assigned to at that time, to be able to do anything about abuse.

[brianlb]

Originally Posted by Matth

[snip] In NTL CABLE, you have your MAC address, and your typically 99% consistent IP address.
In NTL (or any other) dialup, authentication (probably wrong to call it log in) is performed, so they must have the capability to log which user an IP was assigned to at that time, to be able to do anything about abuse.

So it may be relevant that I'm using an NTL cable (telephone) connection *and* NTL dialup.

Incidentally I'm still getting lots of messages purporting to have come from my (virus-free) PC and "returned" to me as undeliverable for various reasons -- mainly exceeding the recipient's mailbox quota. So no doubt NTL soon will be cutting me off and demanding that I debug my computer again. And there seems to be nothing I can do about it apart from changing my e-mail address, which for various reasons would be incredibly inconvenient.

The whole thing seems wrapped in a mystery inside an enigma, though, even for all you tecchie chaps.

Cheers!
Brian

[Halcyon]

Most of the ones i get are from some address called SamSeventy.

Originally Posted by monkeybreath

urm... am i wrong in thinking that every device that connects to the internet has a mac address??

Well yes, and no.

Dialup modems do not have a MAC address - but when you connect to a network they are assigned a dummy one by DUN.

Originally Posted by brianlb

Incidentally I'm still getting lots of messages purporting to have come from my (virus-free) PC and "returned" to me as undeliverable for various reasons -- mainly exceeding the recipient's mailbox quota. So no doubt NTL soon will be cutting me off and demanding that I debug my computer again.

All the netsky and a few other worms spoof the sender address from the address books on the infected pc - so someone who has you in their address book is infected. You should be able to trace the IP of the infected machine(s) from the e-mail headers. It is nothing to do with your machine and NTL should be well aware of this fact.

[brianlb]

Originally Posted by Pem

All the netsky and a few other worms spoof the sender address from the address books on the infected pc - so someone who has you in their address book is infected. You should be able to trace the IP of the infected machine(s) from the e-mail headers. It is nothing to do with your machine and NTL should be well aware of this fact.

Thanks. I've tried to work that out but without success. If I were to post here the full source code of one of these "returned" messages, would you be able to spot the IP of the infected machine? It would make for a rather lengthy message, is all...

Cheers
Brian

[Chris W]

Originally Posted by brianlb

Thanks. I've tried to work that out but without success. If I were to post here the full source code of one of these "returned" messages, would you be able to spot the IP of the infected machine? It would make for a rather lengthy message, is all...

Cheers
Brian

If you are using outlook express, right click on the message and chose properties then details. Copy and post what is in there and i will tell you which ip address you are looking for

MB

[BootBoy]

Oh well.

I filled in the form, I Sent an email to abuse, and all I got form my troubles was an autoresponse, with an incident number.

I'm still getting the mails with virus' attached to them. These do, however come from a different machine, but still in Leeds on the NTL network

Luckily, so far I've had nobody screaming abuse at me, but I guess it's only a matter of time.

Nice of NTL to get back to me with what they are doing about this.

[Chris W]

ntl will probably be receive thousands of these reports per day because the netsky and bagle viruses are so prominent at the moment. So don't expect to get a reponse from the abuse department.

But trust me things are being done so the problem shouldn't go on for too much longer.

[BootBoy]

Originally Posted by monkeybreath

ntl will probably be receive thousands of these reports per day because the netsky and bagle viruses are so prominent at the moment. So don't expect to get a reponse from the abuse department.

But trust me things are being done so the problem shouldn't go on for too much longer.

I know mate, It's just infuriating to not get a response. I know as users of the network it's in our interests to report this kind of thing, but we are acting as the eyes and ears for NTL. It would be nice just to be able to get closure on incidents that we report, just to reassure ourselves that the form filling is worthwhile.

Look at mynetwatchman for example, many ISP's report back to them with the action they have taken to remove problem machines from the web. It's satisfying to know that another abuser has been removed for all our sakes. If others can do it, then I'm sure NTL could if they had the motivation.

I had some Email correspondence with a guy called Michael James who works in Technical support a while back. He was very helpful and tried to answer my questions, but skipped over my question about mynetwatchman.

Even if it was just a simple web page that aggregated the incidents reported and commented on the resolutions.

I'm sure there are many fine people doing what they can to keep the network a secure place, but unless there is feedback, there will be cynics like me moaning about lack of action!