----- Original Message ----- From: "Patrick Burm" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, November 26, 2004 7:32 PM
Subject: Re: [IMail Forum] Dictionary attacks
I have to agree with Cycle Rider, Black Ice is NOT very CPU intensive. I think that perhaps the info from the other poster might have been skewed by having the GUI for BlackICE open during tests. The GUI can be CPU intensive as it is updating itself. But the service itself never seems to get above 1%, even during heavy times of auto blocking. By the way, the 1% reading was on a PIII 733
With the GUI open, I've seen the GUI process as high as 17%.
This is not unreasonable given all that is accessible and being updated in that GUI, and it would not need to be left open unless you are making edits, or checking logs, etc.
I've been running for a while with BI set to auto block for 3 months these harvest attempts. At first it seemed to be a blessing, but after the firewall.ini file grew to over 50,000 IP addresses (and by that nature 50,000 lines of blocks), BI begain killing our mail servers performance. Processor utilization went from bouncing back and forth between 1 and 40 percent(large mail), it stayed at 100% and mail transfer suffered greatly. I just cut out 90% of the blocks in the ini file, and utilization went back to normal. Seems that BI doesn't cache this information which is very bad. It would be much better if it would keep the file in memory until the file needs updating, then do a write/cache update and keep trucking.....Time to go back to the drawing board....
Regards,
Jason
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
