Subject: [fwtk-users] Re: Possible bug in the smap RBL style lookup pa tch

From: "Michael St. Laurent" <[email-masked]>
Date: Tue, 15 Jan 2002 10:22:25 -0800

OK, but your code is using the actual IP address of the sender and not the
spoofed IP address, yes?

--------------------
Michael St. Laurent
Hartwell Corporation

[root@earth] root# rm -rf /bin/laden

> -----Original Message-----
> From: Rick Murphy [mailto:[email-masked]] 
> Sent: Monday, January 14, 2002 6:55 PM
> To: fwtk-users
> Subject: [fwtk-users] Re: Possible bug in the smap RBL style 
> lookup patch
> 
> 
> At 11:48 AM 1/14/02 -0800, Michael St. Laurent wrote:
> >Recently a piece of spam was received here that I believe 
> should have been
> >caught by the RBL DNS lookup style spam patch but was not.  
> I have the
> >following in my netperm-table file:
> ...
> >However, a check with the osirusoft database shows that the 
> OSRELAY rule
> >should have caught this one.  Is it possible that the 
> spoofing on the first
> >line of the log messages prevented the DNS check from 
> working correctly?
> 
> That's strange - the entry in relays.osirusoft.com is there 
> and returns the 
> right value; it was added/updated on 12 December, so it's not 
> a new entry.
> The RBL lookups always use the source IP only - the failed 
> reverse DNS 
> lookup doesn't make a difference.
> 
> About my only guess is a nameserver hiccup of some kind or another.
>          -Rick
> 
> 
> ---
> You are currently subscribed to fwtk-users as: [email-masked]
> To unsubscribe send a blank email to 
> [email-masked]
> 

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Tue, 15 Jan 2002 17:23:13 -0500

>OK, but your code is using the actual IP address of the sender and not the

Yes, the actual address.
         -Rick

---