Re: Seeking DoN

Rich,

        I'm posting this as well as sending a "Cc: " to you, so if
others have been having problems contacting me, they will also know why.

In article <[EMAIL PROTECTED]>,
Richard Morse  <[EMAIL PROTECTED]> wrote:
>I've tried e-mailing DoN at [EMAIL PROTECTED]
>and keep getting:
>
>Persistent Transient Failure: Delivery time expired
>Final-Recipient: rfc822; [EMAIL PROTECTED]
>Action: failed
>Status: 4.4.7 Unable to contact host for 1 days,
>Diagnostic-Code: smtp; Persistent Transient Failure: Delivery time expired
>
>Is there a problem with this address? Does anyone have another address 
>for Don Nichols?

        This *is* the proper address.

        The problem is that you have Comcast as an ISP, and I have been
*flooded* by spam relayed through systems on Comcast, and have been
adding IP addresses to block based on the spam (and virii).  Normally,
this policy only blocks individual systems, and not the mail servers
which all customers should be mailing through, and virii and spam from
infected/backdoored systems normally send direct from the system to the
victim, so only they are blocked.  But, the flood of swen virii happen
to actually use the ISP's mail server, and before I realized that, I had
several mail servers in the blocklist.

        The blocklist consists of raw IP addresses, not system names,
and there are currently 34831 block lines in there -- with more every
day, so unless you can find the IP address that your mail server is
using (perhaps by e-mailing to someone else (not on Comcast) who can
post it or e-mail the headers to me, so I can find out which Comcast IPs
your e-mail is coming from, the odds are poor.

        One possibility is for you to e-mail it to me from somebody
else's system, or get an account on some other system (e.g. get one of
those 1025 free hours accounts with AOL on another computer, so it does
not mess up your connection to your own ISP.)

        Another possibility is to lean on Comcast to do a better job of
shutting down accounts which are virus infected or used for sending
spam e-mail.  They pretty much ignore complaints to the abuse account
from non-Comcast users.

        My logs since 3:10 AM on November 23rd show 43753 mail
connections refused.  I have no way of knowing which of those happen to
be yours.
        
        Of those refused from comcast, there are currently 204 different
machine names.

        A bit of analysis of those logs show the following as the top
number of refusals (with the count of attempts preceding the machine
name):

 ======================================================================
  10 pcp02028901pcs.midltn01.nj.comcast.net
  14 pcp05073837pcs.ivylnd01.pa.comcast.net
  24 pcp110579pcs.wchryh01.nj.comcast.net
 185 rwcrmhc12.comcast.net
 213 rwcrmhc13.comcast.net
 ======================================================================

        On the off chance that the two with the most counts are real,
I'm turning them back on.  One was blocked on:

        Wed Aug 27 13:27:39 EDT 2003

and the other on:

        Sat Sep 6 14:42:23 EDT 2003

        The second one was certainly after the flood of swen had just
started, and before I started blocking e-mails based on size.  The first
one may have been during the first days of swen, before it was obvious
that it was a flood of a new virus.

        Now, I (and my users) are protected by a blocking based on size,
which also means that large attachments won't get through, either.

        Squeeze On,
                DoN.
-- 
 Email:   <[EMAIL PROTECTED]>   | Voice (all times): (703) 938-4564
        (too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
           --- Black Holes are where God is dividing by zero ---