Think that China is reading here to.

Why would you think that?

Well, that's great, but that's 18 addresses. You'd be abusing the whois server if you went step by step like that. Besides,

China (CN) has 800 different allocations and if you want to make life easier in the 61.x block, try 61.128.0.0/10 (61.128.0.0 - 61.191.255.255). Or just try

Old guy

Becuse my firewall whas overrun by call´s mostley att the 1026/1027 gate´s, but there was onley this

I will never abuse any whois or arpanet servers.

Sorry but this is like throwing pearl at a pig. I have find this book "Learning GNU/LINUX" by Linus Walleij who mybe can get me over the next hill.

I am aware that there is alot for me to learn and you are one of the person i am actualy have a great deal of respect in along with some other. My knowledge is a bit poor but I am reding a lot here and on other newsgroups, I have done this for almost a year now.

Andersajja

UDP or TCP?

I'm sorry, but I misunderstood your meaning. Actually I don't think that many people who are producing or running mal-ware really read this group that much.

Again, I misunderstood your meaning. In the history of blocklisting, things started out by blocking specific hosts that were being abusive. As more hosts from the same area of address space, people decided to try to block all space from an entity (a company, or ISP. or similar). As the problem got larger, some people have decided to block whole countries or even regions of the world.

This is not an easy task, because address blocks were not assigned with this thought - looking at the block from 202.0.0.0 to 202.255.255.255, I see there are 2976 assignments to 45 different countries from the Western side of the Indian Ocean to Hawaii. There really is no pattern to the assignments. Also, many domain names do not reflect the country or region where they come from. There are literally thousands of companies with a .com domain in China or Chile or Belarus or Belize. Also as many have noticed, not all network administrators follow the rules that _require_ reverse DNS (IP to name) tables.

First read as "throwing Perl at a pig" (Perl is called the "Swiss Army Chainsaw" of scripting languages). Actually, this is an example of the way Unix tools are used - each tool can do one task very well, but you can chain commands together to do what appear to be very complicated tasks. Perl is another tool that would also do the job, and is available in the Windows or Macintosh environment.

When you look at the hill, it seems VERY steep. Just take one step at a time, and you will reach the top of the hill. I have a number of years experience, and the reason I show the commands like above is so that people can see how it is done.

Knowing how (or even why) to ask a whois server shows that you are learning well. Please continue. This is good!

Old guy

On Thu, 07 Apr 2005 09:24:17 GMT, anders spoketh

Yeah, nothing new there. A bunch of messenger spam has been coming from China for the past 6 to 9 months. It's just blasts of junk at random targets...

Lars M. Hansen

Yes I now that, but I do believe that you understand that it was not the script-language I was thinking of in the first place.

But like the child, I now there is something on the table, but I can´t get it yet.

Thank´s this is meaning a lot to me. Andersajja

Thinka about it. Since UDP is a connectionless protocol, and no handshake is needed, you can easily send UPD M$ messenger spam from a completely forged IP address. No need to worry about the ACKS being routed back...

UDP messenger spam is usually forged and almost impossible to trace back to it's true sourece.

Correct. Further, if you are counting bits over the wire, blocking the source address does not prevent the packet. Think about how the connection occurs. In TCP, There is a minimum of two packets sent

Source -> Destination: Hello, I have a transmission for you. Destination -> Source: Hello, I don't want to speak to you.

and that is the end of that. By the way, if your firewall is "stealth" then the source tries three times before quitting:

Source -> Destination: Hello, I have a transmission for you. Source -> Destination: Hello, I have a transmission for you. Source -> Destination: Hello, I have a transmission for you.

so stealth is going to be more expensive in bandwidth over the connection. Now for a UDP packet, it looks like this:

Source -> Destination: Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam, Spam Destination -> Source: I don't want to speak to you.

and as you can see - it's to late, because it doesn't matter what, if anything, that the destination does. All your computer can do is to throw away the spam. If for example, you have a firewall that prevents this packet from being passed up the stack, or if your computer isn't listening to the port, this happens automagically. If you are paying for a connection by the byte, you may wish to discuss blocking with your upstream, so that they drop these unwanted packets for you. Naturally, they will probably want to charge you for this special service. ;-)

I think you mean "UDP messenger spam is almost always forged and almost..."

"Messenger" is a rather primitive (and broken) version of the BSD 'talk' service from about 1984, which itself was a network aware version of the 'write' service that was part of (UNIX) Version 6 from 1975. Other network operating systems like Lantastic, Banyan Vines, Novell Netware and Tenex had similar functions. I think maybe the second thing you learned when working with them was how to turn that d4mn service off. Luckily for us

Old guy

You're not alone receiving spam from this company on ports 1026 & 1027. I am getting a few per day from 61.172.249.200 but 61.172.249.201 is sending spam packets every 2min 25 secs - that adds up to about 700 per day. Check out the messages under the header of "Why you have hardware firewalls" in this group.

I am sending reports on a daily basis to snipped-for-privacy@waei.com.cn and snipped-for-privacy@ccert.edu.cn. So far there has been no let up in the flow but fingers crossed.

Moe,

What is the significance of whether the spam packets are UDP or TCP?

I am also receiving here UDP packets from 61.172.249.201 on ports 1026 and 1027.