bad DCC traffic from e-corp.net

Hello,

Sorry for causing problems...

I installed dccproc to use with spamassassin, as it is a requirement, and
was unaware that it was causing these problems. It did appear to be
working well at first, but I now see a lot of dccproc connection refused
messages in the logs.

It is a fairly busy mail server and we do get a lot of spam to harvested
addresses from our web site. I appologize for the lack of info for e-corp,
as the domain has changed to sitesell.com, but the server names were not
changed.

I've disabled the dcc checks in spamassassin and appologize for any
problems this has caused. I did not intend to abuse the service. I have no
idea why the client is sending the bad data.


Regards,

Trevor Astrope
astrope@e-corp.net

On Mon, 2 Sep 2002, Vernon Schryver wrote:

> Does anyone know anything about e-corp.net or
> Goodbytes Information Products Inc
>
> I am seeing DCC traffic from 216.95.221.3 or server2.e-corp.net
> that could be considered abusive.  It consists only of zillions of DCC
> NOP operations.
>
> There are some other hosts that do almost as much.
>
> I wonder if the cause might be the recently advertised PC code.  I
> suspect that code lacks the shared map file containing RTTs and other
> information of the proper DCC design, and as a consequence, every
> operation involves a round of RTT measuring.  The result of that is
> currently a 6 fold increase in the load imposed on the public DCC
> servers by that software compared to a proper design.  When more public
> DCC servers are available, the problem will be worse.
>
> What countermeasures are appropriate?
>
>
> Vernon Schryver    vjs@rhyolite.com
>