Archive for the ‘blackhole’ tag
Blackholing spammers using BGP
Today I came across the idea to blackhole spammers and open relays using BGP.
Despite the minor problems it may cause, it will help to solve a big problem.
Taking such aggressive actions like completely blocking a host or even a network for a whole week will make network administrators to take spam issue more serious. If someone forgot (or even worse, is unable) to secure his mail or proxy server, this is his problem not ours. And network administrators should know that they have to act against open relay and proxies in their network with high priority among their tasks.
Anyway, searching in google turned out that my genuine idea is not genuine at all and this is something that Paul Vixie has been working on it since 1997.
His efforts is available as MAPS. Beside their DNSBL service they also offer a BGP feed that does that same as I mentioned. Subscriptions is required to use these BGP feeds.
Blackholing Bogons, eBGP way
Team Cymru, which is well known by their Secure IOS Template and Secure BIND Template, has another interesting project that automates blocking of bogon routes in a network.
Bogon Route Server Project realizes a simple idea: Injecting an up to date list of bogon routes into your network that you can easily route them to Null. You do not need to maintain a long list of static routes and keep track of updates from IANA and update your list periodically. Team Cymru takes care of the tracking, and updates their bogon list once a new allocation takes place.
The only thing you should do is to contact them and setup a Multihop eBGP peering with one of their route servers in order to receive the list of bogons, and also performing some route-map stuff to route injected addresses to Null.
Team Cymru is operated by Rob Thomas of Cisco Systems and a group of individuals that are active in networking field. Their goal is to share their valuable experience with other Networkers via their website.
