Re: Spam sent from compromised (web)hosts vs botnet spam

On Mar 22, 2013, at 9:23 AM, Paul Ferguson <[email protected]> wrote:

> On Fri, Mar 22, 2013 at 9:15 AM, Dan Oetting <[email protected]> wrote:
> 
>> 
>> But we're getting close. I floated the idea of using ICMP as a feedback mechanism and I intend to follow up on that. The next step is to start documenting the concept on the wiki (does everyone know about the wiki?). Then the default behavior of existing systems to these packets needs to be documented to identify if there are any potential damaging side effects. For this step I could definitely use some help from the group as the variety of systems I have access to is limited. I think we could call this "research" if data is actually collected and documented.
>> 
> 
> Just think out loud, but there are still a non-trivial number of
> networks out there which block some ICMP traffic for various reasons,
> some not so smart. :-/

Many of them block unrecognized ICMP traffic. A non-trivial number
block type 3 and 4...

The odds of getting widespread support for ICMP based feedback (unless,
perhaps, it's proposed by a major router vendor) seems about as likely
as RFC 3514 ( http://emailstuff.org/rfc/3514 )support.

It's a mildly interesting thing to think about technically, but deployment
issues should probably be one of the first things to consider.

Cheers,
  Steve

-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org