Home page logo

nanog logo nanog mailing list archives

Re: Stealth Blocking
From: "Eric A. Hall" <ehall () ehsco com>
Date: Thu, 24 May 2001 11:09:52 -0700

Remember that the spammer is handing the "open" relay one piece of
mail with zillions of RCPT TO:s - rate limiting the outbound just
means that the zillions of recipients sit in *your* queue that much

I will add "further punishes/diminishes the harm of open relays" to the
"pro" column. ;)

I have heard from multiple sources that the spammers are well clued
enough to utilize multiple relays in parallel - if you rate limit to
1/N of bandwidth, they just use N relays at the same time.

If the rate limit is applied to *:25, then the *MORE* relays the spammer
uses, the longer it takes for him to do it.

Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]