Comcast takes steps against botnets [Telecom]

Alas, "Pop-ups warn of infections" is the mechanism as well of the purveyors of malicious software. I'd fear that Comcast users who're aware of that fact will ignore Comcast's pop-ups, while Comcast users who're more naive will come to trust even _un_trustworthy pop-ups.

Not all that clear which side will be the ultimate beneficiary.

Cheers, -- tlvp

-- Avant de repondre, jeter la poubelle, SVP

Comcast actually shut down email from my router to a mail account about a year ago. I had set up my router to mail me logs and then a housemate got hit with a zombie and the router began sending out hundreds of messages to warn me about the blocked attacks. Comcast was convinced that a machine on our network was making zombie connections when actually it wasn't. It was just the router. Now I can't use the router to send me logs anymore. I can't convince Comcast otherwise.

Check the Email setup in your router. You may be able to bypass Comcast's block by changing the "From" and or "Subject" line. On some that include the LAN address as part of the outbound info you may also need to change your router's LAN to another subnet, as in changing

An alternative that I use is to create one of those throw away Email address' at one of the free email sites, like Google, or Hotmail (which now allows POP3 access for everyone). Let the router use that as the email server to contact rather than one of Comcast's email hosts. I have numerous email accounts with 5 different email servers. One of which is being used by a Linux file server to send me reports on what is going on in the box. For just the reason you experienced, reports too numerous to count during a possible emergency or confused server is why it's reports all go to an account created just for it. That way should the worst happen and the account gets blocked , I can close or ignore that account and open another for future reports once the server problem is fixed.

I'll add some other options:

1. Consider paying for a business account. They're much easier to talk to on the business side of Comcast, and you'll be able to set something up, perhaps with a "tag" in the subject or in an "X-" header, that identifies the automated emails as such.

1. Check if your paging email address can accept mail sent directly from your router. Some will, most won't, but it's worth a shot.

2. Send emails on a non-standard port. There are services available which will allow you to send emails on the "high" TCP port numbers that Comcast isn't likely to choke: you'll need to program your router to connect to an SMTP gateway on the new port number.

1. Use a VPN (Virtual Private Network). If you have an account at a cluefull ISP, you'll probably be able to set up a VPN tunnel for outgoing email. Currently, Comcast isn't blocking these, although that may change.

HTH.

Bill Horne Moderator

I had to get Comcast last year when the frequency(ies) used by Sprint Broadband were repurposed by the FCC. Overall, no problems and the faster down-/up-load speeds are really nice (for example, I downloaded the Win7 RC DVD ISO from Microsoft in just 12 minutes :-)

However, Comcast about 6-9 months ago began blocking port 25. My home firewall sends logs to me (using port 25) through a system at an offsite colo center and those became blocked. Switching to port 587 (email injection) solved that problem and may work for you, too.

Another solution may be an "internal" (to you, on your LAN) relay system that forwards email from port 25 to port 587 using something like a Sheevaplug. A Sheevaplug is a fist-sized Linux appliance using only 4W to 5W of power and sports a GigE port, HS USB 2.0 port, JTAG console port, and a 1.2 GHz ARM CPU; a few pix of one of mine:

as of this moment, that system:

root@debian:~# date Fri Oct 16 19:59:10 UTC 2009 root@debian:~# uptime 19:59:14 up 75 days, 10:33, 1 user, load average: 0.09, 0.13, 0.09 root@debian:~# uname -a Linux debian 2.6.22.18 #1 Thu Mar 19 14:46:22 IST 2009 armv5tejl GNU/Linux root@debian:~# cat /etc/issue Ubuntu 9.04 \\n \\l

as far as performance goes, that SheevaPlug way outperforms a minicomputer DECsystem-2020 compiling and running many of my programs.

When Comcast suspects you're a spam cannon, they block port 25 on your router. This block doesn't care about the content of your email.

The expected solution is that you'll configure your mail client to connect to your SMTP server on port 587 or 465, the standard ports for Message Submission Service.

Thanks to everyone who responded about Comcast blocking messages from my router to an email account when a housemate had a botnet trying to reach him. Though it was blocked, the logs piled up and the router sent out way too many messages.

Anyhow, the router interface web page didn't allow much configuration for sending out emails. Basically, I was allowed to enter a sender address, which had to be a Comcast account due to blocking restrictions most email providers have in place. I couldn't change ports or any other functions.

I forget which software I was using, but it was for I think a Netgear router. I'm now on a Linksys WRT54G using the open source DD-WRT web interface. This interface allows me even less control for logs than I had before.

-- "You're in probably the wickedest, most corrupt city, most Godless city in America." -- Fr Mullen, "San Francisco"

You may be able to program the router to send the logs to a server inside your firewall, where you can make any of the changes that were suggested.

Bill Horne Moderator