Unfortunately, unless the tarpit responds to the first packet with a SMTP welcome banner, the connection won't be tarpitted for longer than the "wait for SMTP welcome" timeout in the client. You need to convince the for end to send some data before they'll get stuck.
I don't understand. This particular connection was repeatedly sending the same request over and over (hence my comment of "moron") so a tarpit would stop the connection but act like a keepalive, keeping the other side from dropping the connection but also not accepting any further data. One would expect ratware to lack application-level timeouts and it would wait forever in the send() call.
BTW, isn't there something in TCP sorta like the higher-layer HTTP redirect, allowing one to redirect a connection to a different address? This would be nice for forwarding a spammer connection to another known spammer and stepping out of the connection. Sort of a "go pester him instead" packet.
