Alessandro Vesely wrote:
[..]
And what about filtering blacklisted IPs at the firewall level, i.e.
blocking (reject, drop, or tarpit) their syn requests? Is it better than
letting spammers consume our mailer daemon resources?
Perhaps a little tangential, but back in 2006/2007 I had a student
implement a scheme for randomised reject/drop of inbound SYN based on
blacklists (http://caia.swin.edu.au/stockade/). A cute (although not
yet proven useful) aspect of our system was that we did the reject/drop
of TCP SYN from origin Y with a certain probability X that faded over time T.
Time T was measured from the last time we 'saw spam' from origin Y. This
amounted to an auto-rehabilitation of blacklisted origins, so that false
positives for 'saw spam' wouldn't have negative impact for more than
<some configurable number> of minutes. (I'm not sure if our software's ever
been used elsewhere, however.)
cheers,
gja
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/asrg