On Thu, 2007-10-25 at 12:27 -0600, Ashley M. Kirchner wrote: > This all started because a few days ago I started getting 3 > servers that are in the Hurricane Electric network sending a ton of > spam e-mails to invalid user names on my network. Ever since I > started dropping their packets, the flow of activity from those 3 > machines increased dramatically. What used to be just a few packets > every minute has now gone to some 5 to 10 packets being dropped every > second. > > E-Mails to them is simply being ignored...at least, I have yet to > hear anything back or to see a change. Is that a place that you can phone? It may have better results to actually talk to someone about a problem emanating from their network, they may not have noticed the problem, especially if they pay no attention to abuse reports or system logs. Whether it's best to reject or ignore is hard to quantify. If the remote end worked in a proper networking manner, a rejection means cease and desist. No further attempts should be made, and that ought to be automatic (at their side of things). Whereas an ignore might be taken as a networking issue that might resolve itself in a little while, so keep on trying, perhaps altering the route. A reject also helps against genuine mistakes. Someone else setting up their network, but getting an address slightly wrong will get an instant response, and stands a better chance of fixing their problem, quickly. But abusers, on the other hand, are virtually impossible to predict. They may well continue to keep trying, no matter what. I don't think you're giving too much away by telling them to go away, rather than pretending you're not home. They'll just hammer away at whatever addresses they have until they change their attack list. You could try both responses, at different times, and see if it makes any difference. You've got more than one thing to consider. Whether there's any difference in your outgoing traffic by responding that's worth worrying about (e.g. daily/monthly quotas). Whether the firewall is keeping track of a lot of things, or not. You could try an approach that tries a few rejects, then ignores them if they don't pay attention to your reject. That ought to be nice to those accidentally connecting, and also be turning your back on those that aren't. -- (This computer runs FC7, my others run FC4, FC5 & FC6, in case that's important to the thread.) Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.
