On Tue, Jan 10, 2006 at 12:58:39PM -1000, James H Thompson wrote: > What time intervals are good when enabling the earlytalker plugin? > Is there something to be gained by using a time period larger than the > default 1 second?
As others have observed, there does appear to be a benefit to higher wait periods; the 1sec delay was chosen as a conservative default that still yields a respectable kill rate. The lowest timeout on SMTP greetings I'm aware of in a mainstream MTA is Exim, which will wait 30 seconds. Ignoring other issues like MUAs that block on the SMTP transaction, don't go as high as that, and allow some leeway for network latency. There's probably a point of diminishing return in how long it's productive to delay, but I don't believe we have enough data to say. I use a 6-second wait. Somewhat cheerfully, it appears that aside from the the spam delivery agents that trigger earlytalker, there's another class of zombie-hosted spamware which itself enforces a quite short timeout, and disconnects the TCP socket if it doesn't see a greeting. I've seen quite a few instances where a dozen or more different hosts whose distribution suggests a zombie fleet will connect sequentially, each waiting about two seconds before disconnecting. So in a way, we won that particular exchange on both sides. :) -- Devin \ aqua(at)devin.com, IRC:Requiem; http://www.devin.com Carraway \ 1024D/E9ABFCD2: 13E7 199E DD1E 65F0 8905 2E43 5395 CA0D E9AB FCD2
