There's a reasonably popular view that having your firewall dropundesired packets instead of sending ICMP rejections is 'moresecure'. It is not; instead it is 'more annoying'.

(Technically this is not quite true; in a very limited set ofcircumstances, dropping all packets for a host can hide someinformation from attackers. The flipside is that dropping some but notall packets usually leaks information about what you're screening.)

Dropping packets is more annoying because attempted connections haveto time out before

I'll lead with Hotmail's spam numbers:

• four emails accepted, and I know for sure that two of them werespam.
• 239 messages rejected because they came from non-Hotmail emailaddresses.
• 24 messages refused because their sender addresses had already hitour spamtraps.
• 10 messages refused due to their origin IP address (5 in the SBL, 4in the CBL, and one from Nigeria).

The case for banning Hotmail entirely becomes more and morecompelling. It's probably time

TCP keepalives are do-nothing packets the TCP layer can send to see ifa connection is still alive or if the remote end has gone unreachable(due to a machine crash, a network problem, or whatever). Keepalivesare not default TCP behavior (at least not in any TCP stack thatconforms to the RFCs), so you have to specifically turn them on.(There are various reasons why this is sensible.)

In Python you can do this with the .setsockopt() socket method,using

Chris Lewis of Nortel recently posted a breakdown of CBL listings byISP in news.admin.net-abuse.email. Here's the top ten of his listing:

375649 chinanet.cn.net130245 cnc-noc.net102931 telekom.gov.tr80936 kornet.net67721 tpnet.pl51671 dtag.de47246 rain.fr3