I had one customer that told me that he had over 5000 simultaneous open connections with no problems and a large number of these were being tarpitted. I have seen postings in newsgroups that claim to have had 7000 open connections on Win2k Pro. I have not yet been able to determine a hard number for this and don't have enough machines here to create that many connections. We have been able to get up to about 1200 or so.
Brian On 06/18/03 3:39pm you wrote... >I find the idea intriguing as well but if you start to slow down connections >wouldnt that just hold TCP connections open longer possibly making fewer >connections available on the server? > >One of the methods of thwarting file sharing sites is to trickle download >many files so that others cannot make connections, would this not have the >same affect as tar pitting spammers? Especially since the pro spammers send >the same spam run through many different servers. > >Just thinking outloud. > >Rick Davidson >Buckeye Internet Inc >www.buckeyeweb.com >440-953-1900 ext: 222 > >----- Original Message ----- >From: "Dan Patnode" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Wednesday, June 18, 2003 3:16 PM >Subject: Re: [Declude.JunkMail] Tar Pitting > > >I'm intrigued by this idea. During a given minute of time I may get 1000 >messages. 1/4 of them are slown down (occupying more SMTP/Declude >sessions), but the burdon is spread out. > >Can this be applied to increase server capacity? If I throttle, at the >firewall, the IPs of spammers, will the load on my server be less? > >Has anyone tried this on a maxed out server? > >Dan > > >On Sunday, June 15, 2003 16:01, Rifat Levis <[EMAIL PROTECTED]> wrote: >> >>People intersted in tarpitting and Declude firewall integration can read >>this. >> >> >> >>I just finished the tarpitting protection for my IMAIL server >>I am sending logs to the kiwi syslog server and forwarding it to SQL to >>analyse data >> >>When in a 2 min period a single ip send mail to more than 5 unknown account >>I am blocking the ip address on my netscreen firewall for 1 >>hour. >> >> >>The next step of this is to integrate Declude to the firewall >> >>I have 3 weight >>weight 10 warn >>weight 15 warn >>weight 20 delete >> >>Instead of deleting weight 20 i will forward it to an account to send data >>to SQL analyse it and then block it for 1 hour . >> >>NOTE : I am sure that KAMI will be interested :) >> >>Best Regards >>Rifat Levis >> >>--- >>[This E-mail was scanned for viruses by Declude Virus >>(http://www.declude.com)] >> >>--- >>This E-mail came from the Declude.JunkMail mailing list. To >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >>type "unsubscribe Declude.JunkMail". The archives can be found >>at http://www.mail-archive.com. >> > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
