Subject: RE: Factored lookup - ML patent claim issue.

From: "Gordon Fecyk" <[email-masked]>
Date: Mon, 21 Jun 2004 21:56:13 -0500

> Moreover, although people don't really think of IP spoofing as a
>  concern due to it's unroutable nature in two way conversations, our
>  tests have shown that Spammers are increasingly taking advantage of
>  this on a one way "Broadcast" stream to drop emails with the proper
>  IP's (especially in a private relay system with NAT'ing).

To quote an old character named Starbuck: "Felgercarb."

SMTP requires end-to-end TCP.  The receiving server needs to talk back to the
sending client to receive mail.  You need two-way communication to use TCP,
hence SMTP.  Who here has demonstrated a practical TCP spoofing attack?

Insecure NATs are another problem entirely but are still at least traceable
to the insecure NAT.

What you're saying here smacks of, well, there are harsher words than
"felgercarb" but they apply here.

> We'd love to show you our prototypes.

I don't think anyone here's stopping you.  Write and send an internet-draft.

-- 
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>

---

From: John Levine <[email-masked]>
Date: 22 Jun 2004 05:19:53 -0000

>>  IP's (especially in a private relay system with NAT'ing).

Asymmetric routing has been a well-known spammer trick for years.
Ernesto Haberli specialized in it.

For people not familiar with it, the mail sender has a fast connection
like a T1, and a slow disposable connection like a dialup connected to
the same computer.  The packets all go out with the IP of the slow
connection, but sent via the fast connection.  This makes it much
harder to detect the fact that the spammer's using the fast connection
since traceroutes will only show the slow one.

This hardly slows delivery at all, since sending e-mail, particularly
with large messages, sends out big packets and gets back little ones.
The only visible IP is the disposable one; when the ISP gets
complaints and cancels the dialup, the spammer just switches to a
different dialup account and keeps going.

If ISPs did ingress filtering, this wouldn't work, of course.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"I shook hands with Senators Dole and Inouye," said Tom, disarmingly.