Message-ID: <37451.166.70.238.44.1231524844.squirrel@webmail.wolfmountaingroup.com>
In-Reply-To: <49672D75.4060201@davidnewall.com>
References: <40416.166.70.238.44.1231467823.squirrel@webmail.wolfmountaingroup.com>
       <20090109064658.GG5038@1wt.eu>   
    <37611.166.70.238.44.1231486566.squirrel@webmail.wolfmountaingroup.com>
       <20090109084540.GH5038@1wt.eu>   
    <40547.166.70.238.44.1231488906.squirrel@webmail.wolfmountaingroup.com>
       <20090109090956.GA28484@1wt.eu>
    <55312.166.70.238.44.1231490626.squirrel@webmail.wolfmountaingroup.com>
    <49672D75.4060201@davidnewall.com>
Date: Fri, 9 Jan 2009 11:14:04 -0700 (MST)
Subject: Re: [ANNOUNCE] Kernel Blocking Firewall
From: jmerkey@wolfmountaingroup.com
To: "David Newall" <davidn@davidnewall.com>
Cc: jmerkey@wolfmountaingroup.com, "Willy Tarreau" <w@1wt.eu>,
       linux-kernel@vger.kernel.org
User-Agent: SquirrelMail/1.4.6
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Importance: Normal
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1445
Lines: 32

> jmerkey@wolfmountaingroup.com wrote:
>> Allowing a server on a dynamic IP range to act as a mail server is what
>> is
>> stupid.
>
> Sorry to be argue semantics, but I think it's SMTP clients that are the
> major cause of spam.  Many, probably most, ISPs provide an SMTP relay
> for their subscribers, and blocking these dynamic addresses doesn't
> present a hard impediment for delivery of their mail to you.  None the
> less, to say that people on a dynamic IP address should be *obliged* to
> go through a relay is offensive.  (Not that you did say that, but I
> think it's what you had in mind.)
>

That's good point, but not what I see in actual practice.  These zombie
systems don't seem to use the smtp gateway for their ranges, they send the
emails direct.  From my observations, most of these systems tend to stay
zombies, since almost all of them are windows systems.

I have discovered that by using this method to block them, once they open
a connection and I start dropping traffic while the connection is left
open it "tarpits" the bots and causes a cascade failure in the botnet
network for about 20 minutes until the systems start skipping the mail
server doing the bocking.

Jeff

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/