[isp-tech] Dictionary Attacks?

[Kevin Hemenway <info@...>]

What are people doing with dictionary attacks? The default is
to, obviously, return a "User unknown", but that's just "as
expected", and doesn't actually /deal/ with the problem.

In an effort to reduce network traffic generating and sending
all those damn messages, I'm now accepting all unknown user
mail, and just sending it to /dev/null. I'm beginning to see
that this won't scale: I'm just getting /more/ dictionary
attacks then ever (25,000 a day and growing), such that
the return traffic I saved by not giving errors is being
replaced by a "oOooh, LOTS of valid users!" mentality.

I've considered blocking IPs, but naturally, most of this
stuff is zombie boxes, so that's not adequate either.

Thoughts or tips?

--
Kevin Hemenway








To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.