Re: SMTP in distributed DOS

[James Raftery]

On Thu, Mar 02, 2000 at 11:34:11AM -0000, Lorens Kockum wrote:
> No they do not need to be open relays.  If they are qmail
> servers that is perfect for the purpose.

Why? There is no appreciable gain. To be effective the attacker needs to
send a small amount of traffic, which is amplified by a large factor and
directed to the victim.

Sending a 1K message to qmail with the intention of it bouncing to your
victim yields a bounce with your original 1K message plus ~200 bytes of
the QSBMF bounce message. If you get a 10K message to bounce, you yield
10K plus ~200 bytes. Those gains are too low to be useful.


james
-- 
James Raftery (JBR54)  -  Programmer Hostmaster  -  IE TLD Hostmaster
  IE Domain Registry, University College Dublin Computing Services,
  Computer Centre, Belfield, Dublin 4, Ireland.
http://www.domainregistry.ie/ Ph: (+353 1) 7062375 Fx: (+353 1) 7062862