Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Wietse Venema (wietseporcupine.org)
Date: Mon Apr 07 2008 - 19:51:36 CDT
> > I'm still under the storm (BACKSCATTER ATTACK) ...
> > I've triend many things such access maps, RBL, etc etc but it
> > still attack my server and eat almost all the bandwidth to the server.
> Has anyone mentioned fail2ban (http://www.fail2ban.org/) in relation to
> this yet? It simply drops all network connections from blocked hosts for
> the interval you specify. It's naturally more useful if you get hit
> multiple times by the same hosts, but I find much bot traffic will send
> multiple messages from the same host in short bursts before trying
> elsewhere. Given the problems you're having, I'd try configuring lengthy
> ban intervals (30+ minutes), and see if that helps. If you do get a
> number of "repeat offenders", it'll at least take some of the load off
> your greylisting service.
Backscatter does not come from zombies. It comes from
legitimate, but mis-configured, MTAs that accept mail
first and then bounce non-existent recipients.