[nsp-sec] AS27595 (Intercage) gone - implications..

[Chris Morrow]

On Tue, 23 Sep 2008, Chris Morrow wrote:
> On Mon, 22 Sep 2008, Jared Mauch wrote:
>>>>> Now that AS27595 has no routing, there could be some
>>>>> interesting effects to the end users. Those who have been
>>> 
>>> as an odd aside, I had a pretty severe drop in inbound spam to my
>>> collection system yesterday... I wonder if that trend will continue or if
>>> it was related at all to 27595 going away. (which I doubt since it was
>>> over most of the day...)
>>
>> 	Now that it's "back" did your rate increase?
>> 
>
> date of 2008-09-??
> date - 15 connects to postfix: 1793274
> date - 16 connects to postfix: 1877183
> date - 17 connects to postfix: 1887443
> date - 18 connects to postfix: 1970753
> date - 19 connects to postfix: 1777092
> date - 20 connects to postfix: 1689313
> date - 21 connects to postfix: 1162918
> date - 22 connects to postfix: 1623203
>
> this is a simple count of ' connect from ' messages in postfix/mail logs... 
> it's not a perfect proxy for spam levels, but it should track decently to how 
> much 'spam' was actually delivered to my mailserver. Note the drop on the 
> 21st, and the raise back to 'normal' on the 22nd. I didn't do today's 
> numbers, but I'll have my shell script chunk through the rest of the month 
> now too... and report back when it's done.

ok, all of 2008-08:
> zgrep " connect from " 2008-08-${d}/mail.lo* | wc -l ; done
date - 01 connects to postfix: 1653678
date - 02 connects to postfix: 1554561
date - 03 connects to postfix: 1388467
date - 04 connects to postfix: 1679226
date - 05 connects to postfix: 1556475
date - 06 connects to postfix: 1694394
date - 07 connects to postfix: 1628698
date - 08 connects to postfix: 768866
date - 09 connects to postfix: 1591167
date - 10 connects to postfix: 1454031
date - 11 connects to postfix: 1690636
date - 12 connects to postfix: 1811824
date - 13 connects to postfix: 1722024
date - 14 connects to postfix: 1731822
date - 15 connects to postfix: 1747785
date - 16 connects to postfix: 1602231
date - 17 connects to postfix: 1304121
date - 18 connects to postfix: 1752833
date - 19 connects to postfix: 1799567
date - 20 connects to postfix: 1745659
date - 21 connects to postfix: 1781978
date - 22 connects to postfix: 1734225
date - 23 connects to postfix: 1566407
date - 24 connects to postfix: 1566351
date - 25 connects to postfix: 1760883
date - 26 connects to postfix: 1799278
date - 27 connects to postfix: 1858868
date - 28 connects to postfix: 1677595
date - 29 connects to postfix: 1762180
date - 30 connects to postfix: 1550785
date - 31 connects to postfix: 1380913

and 2008-09:
  connect from " 2008-09-${d}/mail.lo*  | wc -l; done
date - 01 connects to postfix: 1755072
date - 02 connects to postfix: 1858118
date - 03 connects to postfix: 1831586
date - 04 connects to postfix: 1990289
date - 05 connects to postfix: 1907927
date - 06 connects to postfix: 1717353
date - 07 connects to postfix: 1635746
date - 08 connects to postfix: 1827608
date - 09 connects to postfix: 1849769
date - 10 connects to postfix: 1759687
date - 11 connects to postfix: 1849144
date - 12 connects to postfix: 1693797
date - 13 connects to postfix: 1614453
date - 14 connects to postfix: 1602588
date - 15 connects to postfix: 1793274
date - 16 connects to postfix: 1877183
date - 17 connects to postfix: 1887443
date - 18 connects to postfix: 1970753
date - 19 connects to postfix: 1777092
date - 20 connects to postfix: 1689313
date - 21 connects to postfix: 1162918
date - 22 connects to postfix: 1623203


aug 8th I rebooted/crashed-email :( bad-sysadmin-bad!

-Chris