bad DCC traffic from e-corp.net

Vernon Schryver vjs@calcite.rhyolite.com
Mon Sep 2 17:02:07 UTC 2002


> From: Trevor Astrope <astrope@e-corp.net>

> Here are the instructions in the spamassassin README:
>
>     # tar xfvz dcc-dccproc.tar.Z
>     # cd dcc-dccproc-X.X.X
>     # ./configure && make && make install
>     # cdcc 'new map'
>     # cdcc 'add dcc.rhyolite.com'
>     # cdcc 'info'

That's ok, except that the 'new map' and "add dcc.rhyolite.com'
are respectively unnecessary and wrong.  The map file that comes
with the source points to localhost and dcc.dcc-servers.net.  Those
two shipped entries usually do the right thing if there is a local
server.  If there is no local server or if the local server fails,
requests are instantly sent to one of the public server names listed
in the main DCC web page at
http://www.rhyolite.com/anti-spam/dcc/ and http://www.dcc-servers.net/dcc/
dcc.rhyolite.com has not been listed for months.


> Perhaps there is something wrong with my client. I'm running spamassassin
> on my home machine as well to filter all my mail, and haven't experienced
> any problems. My home IP is 24.200.195.195 if you would like to check to
> make sure all is ok with that client.

    cdcc 'id 101; clients -n' | grep 24.200.195.195

on 192.188.61.3 says that IP address has been heard from once in
the last 20 minutes.
That IP address has been heard from only 9 times in the last 12 hours
at 206.169.162.65
Whatever it is seems to be distinctive of 216.95.221.3, which has
been heard from 6859 times at 206.169.162.65 in 12 hours.  
I've lost the several 1000 counts from 192.188.61.3, which should have
heard from 206.169.162.65 only about a dozen times in 12 hours, because
its narrow ISDN link makes it have a higher RTT and look like a poor choice.


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.