Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2959

Re: Hurting email spammers with iptables

Show all headers | View raw

"S.K.R. de Jong" <SKRdJ@nowhere.net> wrote in news:llafu7$l26$1
@news.albasani.net:

> On Sun, 18 May 2014 09:22:05 +0200, detha wrote:
> 
>>>      Would it be possible, with iptables, so arrange things on my 
side
>>> so that resources are potentially indefinitely consumed at the 
system
>>> with the IP address from which the spam is being sent?
>> You are probably looking for the '-j TARPIT' target. Most 
distributions
>> don't include that by default (because it is too easy to shoot 
yourself
>> in the foot with it - every active tarpit consumes resources on 
/your/
>> server, and it opens you up to being DDOSed just by opening a bunch 
of
>> connections to a tarpit'ed port).
>> 
>> Some have it as a kernel module (e.g. Debian has it in the
>> xtables-addons-common package).
> 
>      Thanks. This seems to be pretty much what I was looking for.

TARPIT does not work, at least not as you desire.

That's because it shrinks the window, which causes the sender to send 
a TCP reset (RST), closing the connection.

The original idea was to allow the spammer to connect to your SMTP 
server and then set the window to one byte, so that each packet 
contains 1 byte, causing the transaction to take FOREVER to send even 
a small message.  But when spammers figured that out, they just 
changed the TCP software to terminate the connection (RST) and go on 
to the next victim.
-- 
buck

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Hurting email spammers with iptables "S.K.R. de Jong" <SKRdJ@nowhere.net> - 2014-05-16 19:47 +0000
  Re: Hurting email spammers with iptables Bit Twister <BitTwister@mouse-potato.com> - 2014-05-17 00:31 +0000
    Re: Hurting email spammers with iptables "S.K.R. de Jong" <SKRdJ@nowhere.net> - 2014-05-17 16:03 +0000
      Re: Hurting email spammers with iptables Bit Twister <BitTwister@mouse-potato.com> - 2014-05-17 16:18 +0000
        Re: Hurting email spammers with iptables "S.K.R. de Jong" <SKRdJ@nowhere.net> - 2014-05-18 02:53 +0000
          Re: Hurting email spammers with iptables Doug Laidlaw <laidlaws@hotkey.net.au> - 2014-05-23 04:09 +1000
            Re: Hurting email spammers with iptables "S.K.R. de Jong" <SKRdJ@nowhere.net> - 2014-05-23 14:12 +0000
              Re: Hurting email spammers with iptables Richard Kettlewell <rjk@greenend.org.uk> - 2014-05-23 16:30 +0100
  Re: Hurting email spammers with iptables detha <detha@foad.co.za> - 2014-05-18 09:22 +0200
    Re: Hurting email spammers with iptables "S.K.R. de Jong" <SKRdJ@nowhere.net> - 2014-05-18 14:26 +0000
      Re: Hurting email spammers with iptables buck <buck@private.mil> - 2014-05-18 18:27 +0000
  Re: Hurting email spammers with iptables "S.K.R. de Jong" <SKRdJ@nowhere.net> - 2014-08-11 17:20 +0000

csiph-web