nanog mailing list archives

Re: Anti-Spam Router -- opinions?


From: "Andy Johnson" <andyjohnson () ij net>
Date: Mon, 5 Apr 2004 12:25:18 -0400



From: "Matthew Crocker" <matthew () crocker com>
Sounds like YABA  (Yet Another Band Aid) solution for spam.  If
rate-limiting the spam packets does an effective job at killing spam.
It  will only make the spammers switch to a distrubuted attack method
using trojaned virus hosts sending 1 mail message at a time.  They are
already doing this in some cases. SPAM is a living breathing entity
that can learn and adapt.  The smarter the network gets at killing it
off, the smarter it gets in attacking.  The evolution of spam/viruses
is astounding and getting quicker all the time.  The turntide box may
be a good solution but it is expensive,   I'll wait for the SNORT
add-on that does the same thing ;)

-Matt


That's exactly what I was thinking when reading their documentation. A large
portion of the spam we receive on our servers comes from hijacked broadband
customers. I don't see how effective it would be rate limiting these guys,
because the source IP is almost always unique. Still, if it could cut spam
traffic by even half of what they advertise (92% on a system similar to
ours), that would help tremendously.

-Andy


Current thread: