From: Wietse Venema (wietseporcupine.org)
Date: Mon Apr 07 2008 - 19:51:36 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

MacShane, Tracy:
> > I'm still under the storm (BACKSCATTER ATTACK) ...
> > I've triend many things such access maps, RBL, etc etc but it
> > still attack my server and eat almost all the bandwidth to the server.
>
> Has anyone mentioned fail2ban (http://www.fail2ban.org/) in relation to
> this yet? It simply drops all network connections from blocked hosts for
> the interval you specify. It's naturally more useful if you get hit
> multiple times by the same hosts, but I find much bot traffic will send
> multiple messages from the same host in short bursts before trying
> elsewhere. Given the problems you're having, I'd try configuring lengthy
> ban intervals (30+ minutes), and see if that helps. If you do get a
> number of "repeat offenders", it'll at least take some of the load off
> your greylisting service.

Backscatter does not come from zombies. It comes from
legitimate, but mis-configured, MTAs that accept mail
first and then bounce non-existent recipients.

        Wietse

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]