IPv6 News

2011 will be remembered for the death of Steve Jobs, Cisco’s refocusing, IPv6’s coming-out party, and more.
Complete info at PCWorld.

[Read more →]

An interesting new paper from the Naval Postgraduate School (paper here, conference slides here) describes what appears to be an interesting new twist on spam filtering, looking at the characteristics of the TCP session through which the mail is delivered.

They observe that bots typically live on cable or DSL connections with slow congested upstreams. TCP sessions from bots turn out to be fairly easy to recognize by RTT, window, and retransmits, something that people have known at least since a paper at the 2008 CEAS conference on the topic.

This paper tries to see whether it would be practical to use that info to manage spam in real time. They have a network analyzer called SpamFlow that figures out per-connection characteristics. Then as a proof of concept they wrote a Spamassassin plugin to train on the data from SpamFlow and try and do filtering. They do some sort of hand-wavey load testing to see whether SpamFlow can keep up with a realistic mail load, and if it trains fast enough that it would provide useful data in real time. They claim that their results show that it does both.

It’s not obvious how best you would use this in combination with all of the other anti-spam tools people we have, most notably blacklists like the CBL that very accurately identify IPs of botted hosts by looking at the characteristics of mail received at large spamtraps. One thing that occurs to me is this sort of thing might be useful if mail moves to IPv6, since building v6 blacklists will be hard due to the size of the address space, while this lets you estimate the bottiness of each connection directly. Also, rather than accepting or rejecting mail, you might slow down mail reception from hosts that seem to be bots, both to give preference to non-bot senders, and because bots tend to be impatient so if you slow down a dubious connection and it gives up, it was probably a bot. The Turntide appliance did something similar five years ago, although it used different heuristics for deciding what to slow down.

This technique looks only at the characteristics of the TCP session, and not at the contents of the session, which means it also doesn’t look at the contents of the messages. It might be useful in contexts where for legal or political reasons the spam filter isn’t allowed to look at the messages, but users want spam filtering anyway. The authors point out that it is in principle applicable to any TCP transaction, so it might be useful against web queries from bots, too.

It’s hardly a FUSSP, but it’s an interesting paper.

Written by John Levine, Author, Consultant & Speaker

[Read more →]

As we say goodbye to 2011, a year that was certainly another time of change and transition in the wireline segment of the telecom industry, we wanted to take the time to look back on some of the major story lines of the past year.
Complete info at FierceTelecom.

[Read more →]

DDI has been typically been something that only the biggest organizations with huge networks purchased. However, there are several strong forces such as IPv6, consumerization, mobility, virtualization and cloud that is making DDI an absolute must-have for organizations today. This will drive the evolution of DDI to Active DDI.
Complete info at NetworkWorld.

[Read more →]

China is likely to test a new Internet protocol in the next few years in an attempt to further develop the country’s Internet, senior officials from the State Council said on Friday.
Complete info at ChinaDaily, EastDay and CRI.

[Read more →]

Just about everything that could go wrong did go wrong in 2011. From embarrassing smash-and-grab attacks to advanced persistent threats, from high-profile breaches to the advent of militarized malware, the bad guys demonstrated repeatedly an ability to adapt to the rapidly evolving landscape of cyberspace.
Complete info at GCN.

[Read more →]

Suburban experts predict top technology trends.
Complete info at DailyHerald.

[Read more →]

Data, according to vendors including EMC, is doubling every 18 months. So logically, the underlying networks transporting this load is also in need of an upgrade.
Complete info at ChannelPro.

[Read more →]

The State Council, or China’s Cabinet, said Friday the government will accelerate the development of the next-generation Internet industry in the next few years and boost the sector’s role in stimulating the economy.
Complete info at Xinhuanet, ChinaDaily and China.

[Read more →]

Testing Program Underscores D-Link’s Ongoing Commitment to IPv6 Development.
Complete info at DigitalJournal, ITNewsOnline and MarketWatch.

[Read more →]