swinog

swinog@lists.swinog.ch

2 participants
2918 discussions

Port 25 Blockade @ Swisscom (Bluewin)
by Steven.Glogger＠swisscom.com 14 Apr '10

14 Apr '10

Hi everyone To officially talk about the "mail problems on port 25 with swisscom dsl" I would like to give you some (technical) information. We had several needs to stop spam from our network: - We're receiving about 30'000-100'000 abuse complaints per month (contains multiple reports per case) - Mail filtering on our infrastructure (our mail servers) are only catching 20% of all spam sent from swisscom dsl - 80% is sent directly from the customer lines. (source: http://www.maawg.org/port25) - About 60% to over 90% of all mails sent over residential customer lines are identified as spam. This is more than 10 millions spam emails per day (~375 terabytes per year) The impacts are clear: - Spam generates a quite high amount of cost within Swisscom (money, personal, time, storage, data, etc.) - Our reputation is getting bad - We might get listed on blacklists (-> impact on legimite traffic) - Customers are getting blocked (e.g. in sandbox) and are not happy therefore (most of the customers are not realizing, that they are sending spam, because they are virus-/trojan-infected) So, what we did and what are we doing? We currently ran a pilot. The productive rollout which will affect all customers will start this week and will take around 2 months until all customers are migrated. Only (ex-)bluewin customers with dynamic adsl-lines will be affected. Swisscom has published an official statement on http://www.swisscom.ch/p25 and modifies the error-message sent to the customer which will be more clearer. The pilot showed very clearly that this countermeasure is very effectful in stopping outgoing spam. Going to the technical part: We're running a transparent proxy on port 25 (smtp) which gets communication from any customer to any port 25 (Layer 4 redirect feature). The proxy is analyzing the email and if it detects that spam has been sent he will reject the connection by issuing an error message to the customer (the mailclient will notice: smtp-error). If the mail is a normal and legitimate email -> no problem: mail will be sent. We will even insert a "received-from:" line in the header. If a bot/trojan is trying to send emails, the customer will not notice. There are no mails beeing stored on the filter server. All decisions are made on-the-fly. Customers, which are virus-affected are handled by the standard abuse process which we have in place (inform, quarantine in a sandbox, etc.). The option for layer 4 redirect is activated via radius - so it can be turned off on request and the customer just has to reconnect. For dynamic customers the option will be activated by default. Customers are asked to authenticate their smtp session and use the mail submission port 587 (not filtered). So, will this affect non-smtp traffic on port 25? Unfortunately, yes. This traffic will be lost. If the customer has a need to use port 25 for other purposes than email he can request turning of the redirecting feature. If a customer usses SSL via port 25 does it work? No, it will be dropped. Customers are kindly requested to use port 465 instead. If a customer uses smtp auth via port 25, will this work? He will receive a smtp error like "sorry, smtp auth not possible. use 587" (error 573). Will we start to block completely port 25 in the future? No, absolutely not. So, I hope things are now getting clearer ,-) Greetings -steven Steven Glogger ___________________________________________________________________________ Cisco CCIE#23778 Network Engineer Telefon +41 44 294 58 41 Mobile +41 79 277 92 35 Fax +41 86 079 277 92 35 steven.glogger(a)swisscom.com ___________________________________________________________________________ Swisscom (Schweiz) AG Network & IT Network Engineering & Operations Binzring 17 CH-8045 Zürich www.swisscom.com

11 14

Trusted Community Representatives
by Joe Abley 13 Apr '10

13 Apr '10

Colleagues, ICANN and VeriSign, with the support of the US Department of Commerce, continue to work towards DNSSEC deployment in the root zone of the DNS. ICANN is looking for Trusted Community Representatives (TCRs) to help us carry out various technical security operations. An announcement can be found here: <http://www.icann.org/en/announcements/announcement-12apr10-en.htm> You can submit an expression of interest here: <http://www.root-dnssec.org/tcr/> DNSSEC key ceremonies are carried out in English. TCRs must therefore have a good understanding of written and spoken English. Regards, Joe

1 0

SWISSLOS-NET not reachable
by Erich Hohermuth 12 Apr '10

12 Apr '10

Dear AS6730-MNT, Currently SWISSLOS-NET (www.swisslos.ch) is not globally reachable cause of a missing RPLS route object. Even the DE-CIX looking glass has no entry (1). inetnum: 91.213.227.0 - 91.213.227.255 netname: SWISSLOS-NET descr: Swisslos Interkantonale Landeslotterie country: CH org: ORG-SIL15-RIPE admin-c: MT8036-RIPE tech-c: MT8036-RIPE status: ASSIGNED PI mnt-by: RIPE-NCC-END-MNT mnt-lower: RIPE-NCC-END-MNT mnt-by: AS6730-MNT mnt-routes: AS6730-MNT mnt-domains: AS6730-MNT source: RIPE # Filtered It might work in your network if you or your upstream don't filter the bgp updates with RPLS. Regards Erich (1) http://www.de-cix.de/content/network/looking_glass.html

2 1

Gmail
by Andreas Weiler - Kabelfernsehen Boedeli AG 12 Apr '10

12 Apr '10

Can a Gmail (google) techie contact me offlist please? I got a question about the Sunrise spam protection. Thank you, Andreas

1 0

outage
by Florian Forster 07 Apr '10

07 Apr '10

Did anyone heard about a current outage @ telehouse in zuerich?

2 2

SwiNOG-BE84 - Beer Event 84 - 12th of April 2010 @ Mama Africa
by Steven Glogger 07 Apr '10

07 Apr '10

hi everybody here's the announcement for the next beer event. the facts for the next event: ----------------------------- Date: 12th of April 2010 Time: starting around 18.30 o'clock Location: @ the "Mama Africa" nearby Cinema Abaton http://www.mamaafrica.ch Registration deadline: 10.04.2010 15:00:00 (Saturday) ------------- Please register here: http://swinog.mrmouse.ch/ since we have to make reservations, i need to know who's coming and who not. If you cannot attend and you're registered please inform me asap (+41 79 277 92 35). -steven

1 0

Do you want to save a legacy Cisco 5505? Last call.
by Gregory Agerba 07 Apr '10

07 Apr '10

Dear List, I am getting rid of a (dinosaur) Cisco switch gear. It is a Cisco 5505 chassis and features the following top-notch, future-proof duly recognized forefront technologies parts: 2 x Power supply WS-C5008B 1 x Supervisor Engine II MMF 4 x 10/100 WS-X5234-RJ45 The box is just about to fossilize in the dust under my desk. Now seriously, this switch will start-up and work. I have no clue what version of IOS it is running. I bet about a ~ 5 years old. The box is quite in a good shape (no scratches at all!). If that is of any use for someone just drop me a line and I will be happy to hand it over next time I am passing by in your region. Otherwise it will go straight to the dustbin. Gregory *NB: that is not an april fool.*

1 1

Save the Date: SwiNOG #20
by Steven Glogger 01 Apr '10

01 Apr '10

hi folks, for SwiNOG#20 --> save the date: 1th of june 2010. details will follow (date, time, registration, etc.). greetings -steven ps: it's not an april's joke.

1 0

Cablecom technical contact
by Quentin Carpent 01 Apr '10

01 Apr '10

Hello, Could someone from Cablecom contact me off-list? (concerning a L2 link). Thanks BRs, Quentin Carpent Network Engineer VTX SERVICES SA Une société du groupe VTX Telecom ================================================================ Av. de Lavaux 101 - 1009 Pully http://www.vtx.ch - quentin.carpent(a)vtx-telecom.ch ---------------------------------------------------------------- VTX, votre partenaire telecom proche de vous ! ================================================================

1 0

Problem access to du in Dubai ?
by Thomas Nederman 30 Mar '10

30 Mar '10

Hello, Since midnight we are having problems sending traffic to du.ae (our datacenter in Dubai (DIFC)). Does anyone else have problems with communication to Dubai/DIFC/Du.ae ? route: 91.189.12.0/22 origin: AS15802 <http://www.db.ripe.net/whois?searchtext=AS15802&inverse_attributes=orig in&form_type=simple> With Kind Regards Thomas Nederman Systems & Infrastructure Penta Consulting SA Voice +41 22 316 1090 Direct +41 22 316 1028 Fax +41 22 316 1099 infra(a)penta.ch <mailto:infra@penta.ch> www.penta.ch <http://www.penta.ch> ______________________________________________ Your applications everywhere, always TM ______________________________________________

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog