nanog mailing list archives
Re: The worst abuse e-mail ever, sverige.net
From: "Mike Nice" <niceman () att net>
Date: Wed, 22 Sep 2004 11:12:44 -0400
Blocking just hides it. I used to believe in port blocking as the solution to many user problems but now I have 3 and 4 page ACL's on my border routers. This does not scale. Yes, I could push this out via radius to the NAS but again this does not solve the problem.
The solution I am working toward is quickly identifying user infections. We are almost there. I collect and record all traffic from the users going to dark space and am almost finished with the system that will identify who held that IP at a specific time. It is all in SQL so that is easy.
Our system is similar, except we block port 25 completely via RADIUS after we detect an outgoing virus or spam, then notify the customer. This eliminates the ACL's on the border routers. The user can still surf freely to download patches while not causing further damage. Some users just don't want to be bothered and just use webmail to send E-mail and keep the block forever.
Current thread:
- Re: FW: The worst abuse e-mail ever, sverige.net, (continued)
- Re: FW: The worst abuse e-mail ever, sverige.net John Curran (Sep 22)
- Re: FW: The worst abuse e-mail ever, sverige.net Randy Bush (Sep 22)
- Re: The worst abuse e-mail ever, sverige.net Patrick W Gilmore (Sep 22)
- Re: FW: The worst abuse e-mail ever, sverige.net Robert E . Seastrom (Sep 22)
- Re: FW: The worst abuse e-mail ever, sverige.net Lars-Johan Liman (Sep 23)
- Re: FW: The worst abuse e-mail ever, sverige.net Paul Wouters (Sep 22)
- Questinair about email policy records to indicate proper source of email (RE: FW: The worst abuse e-mail ever, sverige.net) william(at)elan.net (Sep 22)
- Re: Questinair about email policy records to indicate proper source of email (RE: FW: The worst abuse e-mail ever, sverige.net) Ricardo "Rick" Gonzalez (Sep 22)
- Re: The worst abuse e-mail ever, sverige.net james edwards (Sep 21)
- Re: The worst abuse e-mail ever, sverige.net Jeff Wheeler (Sep 21)
- Re: The worst abuse e-mail ever, sverige.net Mike Nice (Sep 22)
- Re: The worst abuse e-mail ever, sverige.net Lars-Johan Liman (Sep 23)
- Re: The worst abuse e-mail ever, sverige.net Mike Nice (Sep 23)
- Re: The worst abuse e-mail ever, sverige.net james edwards (Sep 23)
- Re: The worst abuse e-mail ever, sverige.net Lars-Johan Liman (Sep 23)
- RE: FW: The worst abuse e-mail ever, sverige.net Miller, Mark (Sep 22)
- Re: FW: The worst abuse e-mail ever, sverige.net Lars-Johan Liman (Sep 23)
- RE: FW: The worst abuse e-mail ever, sverige.net Kathryn Kessey (Sep 22)