SEO

Well, your script is definately shorter The only diff is that I
block mine up into 10 second blocks. I also want to start looking to
see if any of the early disconnects come back later on for another
shot. So far (in 3 days) only three have come back and they have all
lingered for 396 seconds and 398 seconds.

I've been tallying it up also (total spam seconds accumulated) for
fun... I'm not doing greylisting right now, but when I move this onto
the mailserver I will give it a whirl. I also tack on a spam per
second calc for fun to explain to people... Its not terribly
scientific, but when I tell someone I bogged down 396 minutes of
spammers time over 3 days, they aren't as impressed as saying "in that
time they could have sent 50,000 spam emails out".

I'd be interesting to figure out how exactly they are detecting... Is
it just a quick check on how fast it gets the HELO back? or is it a
total time out ... after 5 seconds just give up no matter what...
Also, many of the responses give back text with "spammer" or "spam" in
it, so they could start checking for that I guess. With your (and my)
10 second drop off, I want to try giving the HELO back faster and see
if that wont clear the "check" to see...

It seems that there are definate quiting points... I added a percent to
my script so it shows % for a given ten second block. So:

33% drop in 0-10 seconds
27% drop in 50-60 seconds (My HELO is not even out by this)
9% drop in 370-380 seconds

I'm going to accumulate some more data and then start tinkering with it
some. It will give me a chance to dust off some very very old C skills
(which were dusty in the first place). I don't expect any great
things to come from my tinkering, but its something fun to play with
anyway

Incidentally if anyone wants to send me raw log files of thier spamd
disconnects it would be cool... I don't have that much to play with
right now.

Here's the 3 days of data with %

0 - 10 62 (33%)
10 - 20 4 (2%)
20 - 30 5 (2%)
30 - 40 4 (2%)
40 - 50 3 (1%)
50 - 60 51 (27%)
... skipping blocks ...
70 - 80 4 (2%)
80 - 90 5 (2%)
90 - 100 3 (1%)
100 - 110 1 (0%)
... skipping blocks ...
130 - 140 2 (1%)
... skipping blocks ...
330 - 340 1 (0%)
... skipping blocks ...
370 - 380 18 (9%)
... skipping blocks ...
390 - 400 8 (4%)
... skipping blocks ...
480 - 490 2 (1%)
... skipping blocks ...
510 - 520 1 (0%)
520 - 530 1 (0%)
530 - 540 3 (1%)
540 - 550 1 (0%)
550 - 560 4 (2%)
560 - 570 2 (1%)
570 - 580 1 (0%)
... skipping blocks ...
660 - 670 1 (0%)







On Sat, 9 Apr 2005 22:48:44 -0600
Bob Beck <beck@bofh.cns.ualberta.ca> wrote:

> >
> I've frequently done such comparisons myself Bill, although
> my script to do it might be shorter than yours:
>
> zgrep disconnected /var/log/daemon*gz | grep lists | awk '{print $9}' | sort -rn | uniq -c