Hi Mikael,
Aside from the standardization issue, some of the problems with reports as
they stand are that they can be routed to the wrong people, there is no
clear way of verifying the authenticity of the data, and the sheer number of
reports can inundate a given abuse helpdesk such that they are tempted not
to take any action at all.
Having a standardized report format is a great idea. In our experience
information needs to come from a trusted source or people are less likely to
act on the information provided. We've also found it helpful to submit the
reports to the ASN maintainers (ISPs) using real-time BGP routing table
information to determine who is responsible for a given netblock rather than
relying on archaic whois data. The reports are also rolled up into concise
summaries where possible so as not to inundate AS maintainers with
unnecessary data.
If you'd like to quickly determine who is routing a given IP address, you
can send your queries to the CYMRU whois server. More information about it
can be found here:
http://www.cymru.com/BGP/whois.html
Members of NSP-SEC receive reports on a weekly or ad-hoc basis summarizing
what others are seeing emanating from their networks. The reports are in
turn processed by many, such that ISPs can alert their own customers and
downstreams of potential problems. A summary of what types of reports are
submitted can be found here:
http://www.nanog.org/mtg-0310/pdf/cymru.pdf
We agree that having a timestamp is crucial to problem resolution, most
preferably in GMT. We accompany all IP numbers with an ASN which is used to
route the report to the appropriate network boundary. All reports receive a
context quantifying and providing a scope around the data.
Cheers,
Steve, for Team Cymru.