Re: ISP outbound SMTP filtering

On 4-Jun-07, at 7:29 AM, Kevin Kargel wrote:

> Analysis of network traffic is always good to let you know what is  
> going
> on, but doing any analysis to the point of being able to differentiate
> between legitimate traffic and zombies would be extremely  
> difficult.  It
> is pretty much a given that if you do not have defenses in place you
> will have zombie traffic.

You'll probably be able to distinguish zombie traffic and legitimate  
traffic by plotting number of outbound SMTP connections per IP over  
time.  At least it will help you to identify which of your customers  
you need to speak to when you start filtering/redirecting outbound 25.

> Redirection to your mail server is also risky if your mail server  
> allows
> relay by IP.  This would be a pretty sure way to get your mail  
> server on
> the blacklists.  Forcing zombie traffic to your mail server will make
> your mail server appear spam friendly to the world.
>
> If you do silly router tricks to redirect port 25 traffic to your mail
> server I would suggest implementing SMTP auth to limit the zombie
> activity.  This carries it's own frustrations, as you will need to
> reconfigure/educate all of your SMTP users.

It is, nevertheless, the correct thing to do.  Laziness does not  
absolve anyone of their responsibility as an ISP.  Your laziness is  
my spam problem.  Once you block/redirect port 25, you can initiate  
rate limiting on your mail server to prevent zombies from getting any  
appreciable throughput thereby minimizing the risk of being RBL'd.   
If you're going to re-educate all of your users, you should move them  
to 587 in the process..

_______________________________________________
"Eat sushi frequently". - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list