[ppml] Bogons etc...

[Michel Py]

>> Michael.Dillon at radianz.com wrote:
>> Further, I think the place to do this is with DNS,
>> much like many of the spam black lists. 

> william at elan.net
> Its been done with dns, [..]
> If you're interested try bogons.dnsiplists.completewhois.com

[for those of you that have not read the redisfilter draft yet, William
is one of the co-authors and I am grateful for his contribution].

That being said, let's try to nail the coffin on this:

IP filtering on a per-host basis (regardless it's using DNS, LDAP or
something else) is a flawed concept in the first place. In the case of
an SMTP session, it is valid to check the originating IP against a DNS
RBL. If you get into more generic filtering, you just can't do this: are
you going to wait for the hypothetical query against
bogons.dnsiplists.completewhois.com or any other DNS or LDAP based
service to decide to drop or not _each_ packet? Of course not. So
Michael and Leo please stop trying to sell us a generic host-based
filtering scheme based on LDAP or DNS, it just does not work nor scale,
both because nothing can handle every host querying the DNS/LDAP servers
and nothing can even handle a single host querying the DNS/LDAP server
for each packet either.

Filtering IP packets or datagrams is a layer 3 deal, it's done on a
router not on a host, and the feed of the filtering information is a BGP
deal. Grow up, that's what both the theoricians and the operators with
tons of operational experience say. That's why layer violations
generally _and_ in this case are a BAD idea, period.

Michel.