[sniffer] Re: IP Change on rulebase delivery system
Pete
I thought the local gbudb got updates from the service or was that a future
enhancement?
Original message
Subject: [sniffer] Re: IP Change on rulebase delivery system
From: Richard Stupek rstu...@gmail.com javascript:_e({}, 'cvml',
'rstu...@gmail.com');
To: Message Sniffer Community sniffer@sortmonster.com javascript:_e({},
'cvml', 'sniffer@sortmonster.com');
CC:
Can you point me at the documentation for the truncate blacklist and its
usage?
On Thu, May 23, 2013 at 3:36 PM, Pete McNeil
madscient...@armresearch.comjavascript:_e({}, 'cvml',
'madscient...@armresearch.com');
wrote:
On 2013-05-23 15:22, Richard Stupek wrote:
Looks like I have this issue again (pegging 4 core cpu) and resetting
the process doesn't make a difference. Not sure what is causing it but it
does slow down spam detection to 40-50 seconds for many emails. Any ideas
what I can look at or do to resolve this?
Check the message sizes. As part of the newest spam storms we've noticed
that a lot of the messages are huge (65536++). I suspect this might impact
throughput as large buffers are allocated and moved around to handle these
messages. This kind of thing has also been known to cause NTFS to crawl.
Please let us know what you find.
If you are not already doing it -- you should consider blocking
connections using the truncate blacklist. No sense taking on some of these
messages if they can be eliminated up front.
_M
--
Pete McNeil
Chief Scientist
ARM Research Labs, LLC
www.armresearch.com
866-770-1044 x7010
twitter/codedweller
##**##**#
This message is sent to you because you are subscribed to
the mailing list sniffer@sortmonster.com javascript:_e({}, 'cvml',
'sniffer@sortmonster.com');.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.comjavascript:_e({},
'cvml', 'sniffer-...@sortmonster.com');
To switch to the DIGEST mode, E-mail to
sniffer-digest@sortmonster.**comjavascript:_e({}, 'cvml',
'sniffer-dig...@sortmonster.com');
To switch to the INDEX mode, E-mail to
sniffer-in...@sortmonster.comjavascript:_e({}, 'cvml',
'sniffer-in...@sortmonster.com');
**
Send administrative queries to
sniffer-request@sortmonster.**comjavascript:_e({}, 'cvml',
'sniffer-requ...@sortmonster.com');
[sniffer] Re: IP Change on rulebase delivery system
On 2013-05-24 08:38, Richard Stupek wrote: Pete I thought the local gbudb got updates from the service or was that a future enhancement? That's true right now. GBUdb is part of a distributed machine learning system. There is a conversation going on between all SNF nodes where they share their point of view on IP reputations. This happens approximately once per minute, out of band. Each node alerts the system that they have new activity on a given IP. Then, via the SYNC server(s), each node receives a reflection of the consensus on that IP. So, when an IP is new to a node it will be updated within about a minute with the consensus reputation from the other nodes. As there are more interactions, the consensus matters less and the local experiences matter more -- but the conversation continues so the each node is always influencing the other nodes about any active IPs. The conversation protocols are intelligent so that there is just enough traffic to accomplish the learning goals and so that a hostile / compromised node cannot poison the system; and so that each node can maintain it's own point of view about each IP. For example: Say node A regularly corresponds with an ISP in blackhatistan. So, node A sees a mixture of good and bad messages. Node B only gets bad messages from the same ISP. Node A will have a local reputation for the ISP that is good enough to let messages through on that system, but node B will have a local reputation for the ISP that blocks most messages. The consensus of all GBUdb nodes will be somewhere in between. Hope this helps, _M -- Pete McNeil Chief Scientist ARM Research Labs, LLC www.armresearch.com 866-770-1044 x7010 twitter/codedweller # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. This list is for discussing Message Sniffer, Anti-spam, Anti-Malware, and related email topics. For More information see http://www.armresearch.com To unsubscribe, E-mail to: sniffer-...@sortmonster.com To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com Send administrative queries to sniffer-requ...@sortmonster.com
[sniffer] Re: IP Change on rulebase delivery system
Sorry, but CommTouch is not a viable cost effective solution for most of us anymore. If you are a long time Imail user/admin you should be aware of this. -Original Message- From: DFN systems off...@dfn.com Sent: Thursday, May 23, 2013 5:30pm To: Message Sniffer Community sniffer@sortmonster.com Subject: [sniffer] Re: IP Change on rulebase delivery system Commtouch Ryan Bair Original message Subject: [sniffer] Re: IP Change on rulebase delivery system From: Richard Stupek rstu...@gmail.com To: Message Sniffer Community sniffer@sortmonster.com CC: Can you point me at the documentation for the truncate blacklist and its usage? On Thu, May 23, 2013 at 3:36 PM, Pete McNeil madscient...@armresearch.com wrote: On 2013-05-23 15:22, Richard Stupek wrote: Looks like I have this issue again (pegging 4 core cpu) and resetting the process doesn't make a difference. Not sure what is causing it but it does slow down spam detection to 40-50 seconds for many emails. Any ideas what I can look at or do to resolve this? Check the message sizes. As part of the newest spam storms we've noticed that a lot of the messages are huge (65536++). I suspect this might impact throughput as large buffers are allocated and moved around to handle these messages. This kind of thing has also been known to cause NTFS to crawl. Please let us know what you find. If you are not already doing it -- you should consider blocking connections using the truncate blacklist. No sense taking on some of these messages if they can be eliminated up front. _M -- Pete McNeil Chief Scientist ARM Research Labs, LLC www.armresearch.com 866-770-1044 x7010 twitter/codedweller # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. This list is for discussing Message Sniffer, Anti-spam, Anti-Malware, and related email topics. For More information see http://www.armresearch.com To unsubscribe, E-mail to: sniffer-...@sortmonster.com To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com Send administrative queries to sniffer-requ...@sortmonster.com # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. This list is for discussing Message Sniffer, Anti-spam, Anti-Malware, and related email topics. For More information see http://www.armresearch.com To unsubscribe, E-mail to: sniffer-...@sortmonster.com To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com Send administrative queries to sniffer-requ...@sortmonster.com
