Spammers hapless fate = ISP toil and sweat

In message <199709171559.RAA27727 at nix.swip.net>, "Jorgen Ericsson" writes:
>On 17 Sep 97 at 16:01, Poul-Henning Kamp wrote:
>
>- snip -
>
> >a pan-european filtering of all AGIS and IEMMC member networks 
> >until such filtering is in place.  It should be pretty simple to 
> >simply filter all routes based on AGIS AS#(s), and maybe inject 
> >a bogus route for the IEMMC members networks.
> >
>
>I wouldn't recommend that. They will receive our routing and then their 
>ip-packets will still get here - and we will all experience something very 
>nasty.... It's pretty close to SYN-flooding.

No worries:

1. AGIS will act swiftly to get this fixed, they also have serious
   customers.  It would make a very bad dent in their reputation to
   be locked out of a continent.

2. Your host will receive "host unreachable" and not keep the TCP
   session block around.

>What should be done is to have our transit operators stop announcing
>our networks to AGIS/IEMMC. Then they will not get their packets over
>the atlantic and we wouldn't have to bother.

That is far more complex and probably downright impossible to orchestrate.

>But they will probably set other american hosts as relays and go from
>there...

Well, then somebody else in America will take action, because we'll just
move over and block them next if they don't act.

Remember, making their IP numbers useless is the hardest way we can 
hit them, get new IP# are not easy (the fact that you're on this 
mail-list means that you know that :-)

For this to work, we need to get europe to work as a block, if the
bigger party blocks the smaller, the smaller has a problem.  If the
smaller party blocks the bigger, nobody cares.

--
Poul-Henning Kamp             FreeBSD coreteam member
phk at FreeBSD.ORG               "Real hackers run -current on their laptop."