> -----Original Message-----
> Sheen, Tony
> Sent: Tuesday, 3 February 2004 10:56 PM
>
> You also have to take into account the number of people that hide Exim
> behind fake Sendmail (and other) banners in an attempt to
> fool would-be
> hackers!!! <grin>
>
> I know of at least 30 sites that do this...
>
> Telnetting to port 25, typing 'help' and checking the results usually
> reveals a lot more than just a banner.
>
> Tony
> --On martes, 3 febrero 2004 12:21 +0100 Frank Heydlauf
> wrote:
> > On Tue, Feb 03, 2004 at 09:36:26AM +0000, Nigel Metheringham wrote:
> >> On Tue, 2004-02-03 at 06:07, Kevin M. Barrett wrote:
> >> > In the past few days I have had three clients ask me for
> an estimate
> >> > of the install-base of EXIM vs Sendmail vs Exchange vs
> MTA X. Has any
> >> > one in the community done any kind of study at all? Nigel, any
> >> > Ideas.... I feel rather foolish when asked this
> question. M$ will tell
> >> > you that they have 43% of the market.
> >>
> >> Well there are lots of different metrics here - do you
> want figures by
> >> installation
> >
> > I'm actually trying to get some numbers. Below the preliminary
> > results. It's a scan of IPs connected to our mailserver (in+out).
> > It will take a couple of hours to scan a statistical relevant
> > amount of hosts.
> >
> > 2 Alt-N MDaemon
> > 2 Novell GroupWise
> > 3 Checkpoint FireWall-1
> > 3 Lotus Domino
> > 3 Trend Micro
> > 4 Exim smtpd
> > 7 IMail NT-ESMTP
> > 9 Postfix smtpd
> > 16 Microsoft Exchange
> > 17 qmail smtpd
> > 22 Sendmail
> > 41 Microsoft ESMTP
> >
> >
> > --
> > Gruss Frank
> >
>
> But what sort of people speak to your mail servers? Presumably, these
> figures could simply be skewed by spammer's preferences. Then
> we also have
> to take into account the type of business that you are in.
>
> --
> Ian Eiloart
> Servers Team
> Sussex University ITS
There are already companies that make their money out of scanning the
internet looking at who is running what web server, how come there isn't
one out there scanning the internet for all the mail servers?
I have some bandwidth to waste and some time to spare, I wonder how much
of a storm I would bring down upon myself if I started scanning the
internet at random and collating the results. There would of course have
to be some rules in place to prevent legal action and such.
- A way to opt your servers/net range out of the scan
- No association between IP and results, just record the greeting, help
reply.
- _PERHAPS_ testing for open relay and not keeping the IP, just count
the number of close/open/keep and reject mail servers out there. Someone
out there is already doing that and I hear it's rather controversial
- Greet with a valid HELO that has a website explaining the whole
proceedure and presenting results.
- To keep the data up to date, expire data and revisit IP's about once
a year.
Information provided by the site could be some of the following.
- Amount of the internet scanned
- Amount of the internet that is not being scanned after being asked
not to
- Percentage of hosts running each main type
- Percentage of version strings presented for each type
- Percentage of open relays
I have re-evaluated my time in the last 30 seconds and I now think that
this would bring down such a storm that neither I, nor my internet
connection could handle the results of this little experiment. Perhaps
I'll just throw this out there and see if anyone else would be
interested in taking up the challenge.
Ted.
