Email volume

Our email volume is following a strange curve. The following numbers come from a week in mid-February (specifically the 11th-17th) for the last four years:

        messages     GB
2003   1 143 641    30.97
2004   2 480 215    62.11
2005   2 199 303   117.86
2006   2 925 334   162.70

Why the drop in message count in 2005? Architectural changes to our email systems meant that fewer messages were going through ppswitch more than once; this year that has increased again because of the unbundling of the mailinglist system. It may also be a result in the changes of behaviour of email viruses (which contribute to the count).

DNS-assisted flooding attacks

http://lists.oarci.net/pipermail/dns-operations/2006-February/000122.html

At the moment there are a lot of DNS-based attacks going on. They generally rely on spoofed queries, where an attacker sends a forged DNS query to an open resolver (the reflector) which sends a large response (amplification) to the victim. A lot of people are saying that wider implementation of BCP38 would significantly reduce the problem, because that requires ISPs to filter spoofed packets at their borders. However the DNS relies on referrals from one name server to another, which can be used for reflecting and amplifying attacks even when UDP forgery is prevented.