[Mimedefang] Re: Spammers who won't take no for an answer

[Jonas Eckerman]

On Fri, 24 Oct 2003 09:54:53 -0700, Jeremy Mates wrote:

> usually ties connections up for five minutes; the message is temp
> or perm failed before the DATA verb, which reduces the bandwidth
> costs.

Just a thought. Is it eating any input while it's "sleeping" (to 
relieve the IP stack)?

I quick check in my web logs shows lot's of spammers trying to send 
mail through the web server (they hope it's a misconfigured/open 
proxy). When they do this, they use POST or CONNECT. When using POST, 
they send their end of the conversation as one huge blob. They don't 
wait for replies before sending DATA and the actual message.

If this is actually common, and often succeeds, (I have no idea 
wether it is or does) then the IP stack could be collecting a lot of 
data while the smtp tarpit (thanks for the definition) is just 
delaying it unless it's eating data instead of only sleeping.

Regards
/Jonas
-- 
Jonas Eckerman, jonas_lists at frukt.org
http://www.fsdb.org/