Re: Req: info on IP range popup ad software supposedly called "Extreme Marketing"

From: Casper H.S. *** (Casper.***@Sun.COM)
Date: 12/31/02 

From: Casper H.S. *** <Casper.***@Sun.COM>
Date: 31 Dec 2002 11:29:07 GMT

Barry Margolin <barmar@genuity.net> writes:

>Actually, we don't really know that. It could be coming from some other
>ISP that *doesn't* do egress filtering. But if the packets can be traced
>back to coming from our backbone, we can be pretty sure that it came from
>Customer A (not totally, though -- we have lots of multi-homed customers,
>and can't enable "ip verify unicast reverse-path" on their connections --
>but we know that it didn't come from Customers B or C, so it's narrowed
>down considerably).

Considering that SPAM is done using TCP it's fairly unlikely that
just the ommisson of egress filtering is sufficient to spoof the
IP address. (It's different for DoS, of course)

Casper 

-- 
Expressed in this posting are my opinions.  They are in no way related
to opinions held by my employer, Sun Microsystems.
Statements on Sun products included here are not gospel and may
be fiction rather than truth.