what kind of horsepower you running this on and why not simply block
them for an hour or two rather than forever?
Jason @ AreaTech wrote:
----- Original Message ----- From: "Patrick Burm" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, November 26, 2004 7:32 PM
Subject: Re: [IMail Forum] Dictionary attacks
I have to agree with Cycle Rider, Black Ice is NOT very CPU intensive.
I think that perhaps the info from the other poster might have been
skewed by having the GUI for BlackICE open during tests. The GUI can
be CPU intensive as it is updating itself. But the service itself
never seems to get above 1%, even during heavy times of auto blocking.
By the way, the 1% reading was on a PIII 733
With the GUI open, I've seen the GUI process as high as 17%.
This is not unreasonable given all that is accessible and being
updated in that GUI, and it would not need to be left open unless you
are making edits, or checking logs, etc.
I've been running for a while with BI set to auto block for 3 months
these harvest attempts. At first it seemed to be a blessing, but
after the firewall.ini file grew to over 50,000 IP addresses (and by
that nature 50,000 lines of blocks), BI begain killing our mail
servers performance. Processor utilization went from bouncing back and
forth between 1 and 40 percent(large mail), it stayed at 100% and mail
transfer suffered greatly. I just cut out 90% of the blocks in the ini
file, and utilization went back to normal. Seems that BI doesn't
cache this information which is very bad. It would be much better if
it would keep the file in memory until the file needs updating, then
do a write/cache update and keep trucking.....Time to go back to the
drawing board....
Regards,
Jason
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
