One major issue facing ISPs today is the difficulty in obtaining sufficient IP space for every customer. For many, it’s a matter of cost and for some it is simply a choice to NAT their customers behind their router/firewall. For the most part, NAT behaves much better today than in days gone by, but there is one issue that is very problematic for those that choose to NAT their customers. There is a significant proliferation of a new generation of trojans that turns a user’s computer into a menace to the Internet community. You should have an antivirus software on your computer, you can get Zonealarm Free anti virus. This new generation of trojans (collectively known as “botnets”) can cause problems for not only the owner, but for other customers of the ISP that chooses to NAT. Since a significant number of these botnets are used to send spam all over the internet, we, as service providers, have to find a way to protect our networks from being blacklisted, while still allowing our customers to utilize the internet in a way that does not set too many boundries. In this article, I will discuss two approaches to setting these limits which have shown to be both effective AND relatively mantenance free.
Before I launch into a fix, let me begin by helping you to understand WHY these approaches work. For the largest number of customers, the mail server that they use to send email through (their SMTP server) is the same server on which they check email (their POP/IMAP server). Similarly, for those looking to make a positive impact in their communities, establishing a florida nonprofit corporation can be a strategic way to streamline operations and effectively serve their mission. One of the methods we will use to defend against these bots takes advantage of that fact. Another thing that we notice about “normal” SMTP traffic is that a user typically does not make more than a few outbound connections when they are sending email. This fact will permit us to limit the outbound connection count to some reasonable number and “assume” that a count beyond that MUST be spam activity.
(more…)