Greetpause seems very ineffective (Was: RE: Increased Volumes Of Spam)

[Dennis Willson]

It's more effecient to use greet pause than RBLs. RBLs take up more 
resources, both yours and the RBL providers. Not to mention the 
metwork traffic of the RBL query (although not very much most of the 
time, I used to host an RBL and if everyone would have reduced their 
traffic just a little that would have made a big difference in my 
bandwidth usage).

I use greet pause as one of my anti-spam tools and I probably get the 
same effectiveness as you... I just consider this as 'free' and a 
savings of resources. I actually get one of my biggest improvements 
with greylisting (yes this can delay email, users learn to live with 
it and it's such a big gain I can't ignore it). Content scanners are 
such resource hogs that I do as much as I can prior to scanning the 
contents so there are a lot fewer emails to scan.

Doing sender verification (making sure the sending email address is a 
real email address) made a surprising difference too.

Hope this helps


On Fri, 19 Jan 2007 22:05:33 -0200
  Durval Menezes <jm153 at tmp.com.br> wrote:
>Hello folks,
>
>Scott Silva <ssilva at sgvwater.com> on Tue, Jan 16, 2007 at 10:24:11 
>-0800, wrote:
>> Greetpause does help a lot, as I probably drop 10 to 20% of the spam 
>>with it
>> alone. Five seconds is a good starting point, but probably not over 
>>30
>> seconds.
>
>The first time I became aware of GreetPause, I dismissed it as 
>probably
>not very effective, because it would be very simple for spammers to 
>adapt
>by just stopping the slam; on the negative side, it would end up 
>slowing
>ALL traffic, including the legitimate (non-spam) emails.
>
>Then I came upon Scott's (and others) recommendations, as above, and 
>I
>wondered if my initial analysis was incorrect; today, I found the 
>time
>to configure one of my servers to use GreetPause, and measured its
>efficiency using pause intervals of 1s, 5s and 10s. The numbers I
>obtained are as follows:
>
>Pause:    GreetPause:  total connections:	pre-greet/conexoes:
>1s     		 14          645         	2.17%
>5s      	 19          383         	4.96%
>10s      	 36          535         	6.73%
>
>What's worse, about 80% of the connections blocked by GreetPause 
>would
>have been blocked anyway by the MTA using RBLs alone, so the 
>*effective*
>Greetpause improvement over using RBLs alone would be about 1% or 
>less,
>even with relativelly large (10s) pauses.
>
>I've rechecked my analysis and found no mistakes; are you folks 
>*really*
>measuring GreetPause efficiency and finding these 10-20% numbers, or 
>are
>you deriving these numbers more from "feeling" or something? What 
>other
>explanations for the above discrepancies can you think of?
>
>If anyone wants to sift through my logs, I can make then avalable;
>just ask.
>
>Thanks in advance for any and all input.
>
>Best Regards,
>-- 
>    Durval Menezes (durval AT tmp DOT com DOT br, 
>http://www.tmp.com.br/)
>-- 
>MailScanner mailing list
>mailscanner at lists.mailscanner.info
>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>Before posting, read http://wiki.mailscanner.info/posting
>
>Support MailScanner development - buy the book off the website! 


--------------------------------------------------
Dennis Willson

taz at taz-mania.com
http://www.taz-mania.com

Ham (Extra Class): KA6LSW
GMRS : WQGF680
Scuba: Rescue Diver, EANx, Wreck, Night, Alt, 
Equip, UW Photographer, Gas Blender

Life should not be a journey to the grave with the intention of 
arriving safely in a nice looking and well preserved body, but rather 
to skid in broadside, thoroughly used up, totally worn out, and loudly 
proclaiming, "WOW! WHAT A RIDE!"