Interesting Scott,
I'm not sure I want to do "true" tarpitting, I want the spam to get through eventually
(just in case its not), just way after the legitimate stuff. I use Netscreen
firewalls and their technical info says throttling to less than 10kbps risks dropping
the connection. The idea would be to slow it down enough to:
1) Give priority to non spam
2) Push spam back in time to momment of low server load
3) Make spammers sending less effecient
Would throttling to 15kbps be slow enough to still make a difference?
Brian,
Alligate looks like a good complement to Declude. Given that it includes features
provided by Declude's decode option, do you know if it takes a smaller CPU hit? Does
running DECODE OFF and Aligate on take less, more, or about the same load on a server?
Thanks!
Dan
On Wednesday, June 18, 2003 12:25, R. Scott Perry <[EMAIL PROTECTED]> wrote:
>
>>I'm intrigued by this idea. During a given minute of time I may get 1000
>>messages. 1/4 of them are slown down (occupying more SMTP/Declude
>>sessions), but the burdon is spread out.
>
>Actually, with true tarpitting, there would be slightly fewer SMTP32.exe
>and Declude.exe processes (they would only get started after the E-mail was
>received). The number of SMTPD connections ("live" TCP/IP connections)
>would increase, but IMail can technically handle 1,000+ simultaneous SMTPD
>connections.
>
>>Can this be applied to increase server capacity? If I throttle, at the
>>firewall, the IPs of spammers, will the load on my server be
>less?
>
>It would be less, assuming that IMail can handle it (and that your firewall
>can do the tarpitting). I'm not aware of any firewalls that can do true
>SMTP tarpitting (which requires sending short bits of data occasionally to
>prevent timeouts), but you could simulate it with throttling.
>
> -Scott
>---
>Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
>Declude Virus: Catches known viruses and is the leader in mailserver
>vulnerability detection.
>Find out what you have been missing: Ask for a free 30-day
>evaluation.
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list. To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail". The archives can be found
>at http://www.mail-archive.com.
>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
