Spamhaus strongly recommends the use of DROP by tier-1 and backbone networks. Simply consulting the DROP list's webpage when someone asks you to route some suspicious IPs can help avoid picking up customers you would just as soon not have on your network.

Please DO NOT auto-fetch the DROP list more than once per hour!

The DROP list changes quite slowly. There is no need to update cached data more than once per hour, in fact once per day is more than enough in most cases. Automated downloads must be at least one hour apart. Excessive downloads may result in your IP being firewalled from the Spamhaus website.

A "hijacked netblock" is a netblock brought back from the dead, often by a spammer, also called a "zombie netblock." (The term "zombie" later became widely applied to the infected PC drones in a botnet.) The original owner of the block may have left it derelict for any number of reasons. Squatters then reclaim it with various ploys including registering an abandoned domain name to accept email to the point-of-contact domain contact, or printing up bogus letterhead, or doing a bit of human engineering over the telephone. Some hijackers even outright steal IP-space allocated to someone else just by announcing it under their BGP Autonomous System Number.

Oh, and Autonomous Systems are hijacked too. Old abandoned ASNs are taken by a spammer or spammer supplier to announce various IP ranges. So it's quite possible to have a hijacked netblock advertised by a hijacked ASN.

Originally a few crufty geeks found these ranges for cheap digs. While their ownership claims were unethical, they did not use the hijacked networks for abuse. All that changed when spammers entered the picture. Then the hijack game became dominated by spammers (and some script kiddies) and it is now wise to accept no packets, but certainly not e-mail, from zombie networks.

Hijacked netblocks can be found in ranges assigned by every Regional Internet Registry (RIR) including ARIN, RIPE, APNIC, and others. Restoring proper ownership of a hijacked netblock means finding the original owner (often a dissolved company) and jumping through RIR hoops. It's a slow and laborious process, important but not suitable to stopping today's spam.

The peering/transit arrangements for these netblocks changes very quickly. Spamhaus leaves the entire block listed in SBL, categorized under the RIR, and then provides additional pointer records for networks carrying the netblocks's traffic. While such records are often only a single router's IP address (/32), the record will indicate the greater problem (and the problem is much greater than a single IP). Spamhaus may also provide additional SBL records within a hijacked netblock as various SWiPs or single IPs within the netblock are assigned to different spammers. These, too, may serve as pointers to the upstream, as the block is sometimes SWiPed as portable subnets with each spammer left to find their own transit. Many of these hijacked netblocks find their way into a special ROKSO record.

Spamhaus lists entire hijacked networks. Some of them are known to be controlled by particular a spammer and are thus listed under that spammer's ROKSO records. Those that are not assigned to another spammer may be assigned to this record. So, it is suggested that anyone searching for hijacked netblocks under their aegis not only check this record's Current SBL Listings, but also check under their domain name and RIR via the SBL search function.

To make day-to-day changes, use -o oldfile where oldfile is the previous version, and it'll give you just route delete and route add for the changes. This script is set up to fetch the current list and update once a day, which is frequent enough for nearly all networks, given the slow day-to-day churn and very conservative listing policy of the DROP list.

Please DO NOT auto-fetch the DROP list more than once per hour!

Usual disclaimers...use at your own discretion!

This site has a shell script for putting the Spamhaus DROP list in FreeBSD's ipfw.

Here's the code for using DROP in Linux firewalls:

Bill Stearns also provides this tcpdump command line. It's tested on Linux and probably works in any Unix/Posix environment, including Cygwin on Windows. A tcpdump error message "Warning: Kernel filter failed: Cannot allocate memory" seems to indicate that the filter can't fit in kernel memory, and it appears that tcpdump then switches over to filtering in userspace.

tcpdump -tnp `cat /var/lib/drop.lasso | sed -e 's/;.*//' | grep -v '^ *$' | ( read OneAddr ; echo -n "net $OneAddr" ; while read OneAddr ; do echo -n " or net $OneAddr" ; done ; echo )`

Here is a script that converts the DROP list into Qmail's tcpserver blacklist: