Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

Mon Jun 23 20:24:41 UTC 2008

Thanks.  Even with TLS, the destination port (either 25 or 365) is
well-known, right, as is the source IP?  At the minimum RBLs could be used
for that encrypted traffic.  

Frank 

-----Original Message-----
From: Joel Jaeggli [mailto:joelja at bogus.com] 
Sent: Monday, June 23, 2008 2:20 PM
To: frnkblk at iname.com
Cc: nanog at merit.edu
Subject: Re: Cloud service [was: RE: EC2 and GAE means end of ip address
reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

<snip>

dpi boxes from a number of vendors can do that sort of thing... whether
they can do it fast enough to be inline with your compute cloud is
another question entirely.

That said the result is fairly perilous when rejecting a message
involves forging packets. and of course tls supporting mta's will be
opaque to the network traffic inspecting device.