<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-IE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Glenn,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">It’s a good thing. Unfortunately for us with Clustered Qmail using NFS they are not cheap at all. Hence the move to a gateway device.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Even putting Spamdyke infront of Qmail in the xinetd wasn’t good enough because each SMTP connection spawns a qmail-smtpd process which reads the control folder
/ configs. Getting 2-3 million of these a day was using excessive Read IOPs on the NFS server.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I have to wonder what our NFS graphs will look like in a couple of days once we’ve moved everything over
</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">J</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Paul<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info]
<b>On Behalf Of </b>Glenn Steen<br>
<b>Sent:</b> 13 September 2011 08:46<br>
<b>To:</b> MailScanner discussion<br>
<b>Subject:</b> Re: Spam Attacks<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>A good thing those rejections are pretty cheap... Imagine having to actually receive all that cr*p and inspecting it with MS....<o:p></o:p></p>
<p>Cheers!<br>
-- <br>
-- Glenn<o:p></o:p></p>
<div>
<p class="MsoNormal">Den 13 sep 2011 00:36 skrev "Paul Kelly :: Blacknight" <<a href="mailto:paul@blacknight.com">paul@blacknight.com</a>>:<br>
> Hi All,<br>
> <br>
> Thanks for your replies. As of today I've pointed 10 domains to a new gateway and here are some stats.<br>
> <br>
> <a href="http://dominion.blacknight.ie/~paul/postfix.txt">http://dominion.blacknight.ie/~paul/postfix.txt</a><br>
> <br>
> It's a bit crazy.<br>
> <br>
> Paul<br>
> <br>
> <br>
> Paul Kelly<br>
> Technical Director<br>
> Microsoft Certified Partner<br>
> Blacknight Internet Solutions ltd<br>
> Hosting, Colocation, Dedicated servers<br>
> IP Transit Services<br>
> Tel: +353(0)599183072<br>
> Lo-call: 1850 929 929<br>
> DDI: +353 (0) 59 9183091<br>
> <br>
> e-mail: <a href="mailto:paul@blacknight.com">paul@blacknight.com</a><br>
> web: <a href="http://www.blacknight.com">http://www.blacknight.com</a><br>
> <br>
> Blacknight Internet Solutions Ltd,<br>
> Unit 12A,Barrowside Business Park,<br>
> Sleaty Road,<br>
> Graiguecullen,<br>
> Carlow,<br>
> Ireland<br>
> <br>
> Company No.: 370845<br>
> <br>
> On 12 Sep 2011, at 17:43, Sergio Rabellino wrote:<br>
> <br>
>> I've got some numbers about my main mailserver :<br>
>> from 3.00 am to 18.00 pm TODAY (italian hours, GMT+2) we refused 30798 incoming messages from dnsbl listed hosts, 2410 greylist entry timed out (spammers trying to send mail once) and delivered 7658 (possibly) legal messages to our (150) recipients.<br>
>> <br>
>> Bye.<br>
>> <br>
>> Il 12/09/2011 10:03, Jason Ede ha scritto:<br>
>>> We're seeing similar, although not at those levels, at around 1pm and 6pm each day.<br>
>>> <br>
>>> Jason<br>
>>> <br>
>>> <br>
>>>> -----Original Message-----<br>
>>>> From: <br>
>>>> <a href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a> [mailto:<a href="mailto:mailscanner">mailscanner</a><br>
>>>> -<br>
>>>> <br>
>>>> <a href="mailto:bounces@lists.mailscanner.info">bounces@lists.mailscanner.info</a><br>
>>>> ] On Behalf Of Paul Kelly :: Blacknight<br>
>>>> Sent: 11 September 2011 21:59<br>
>>>> To: MailScanner discussion<br>
>>>> Subject: Spam Attacks<br>
>>>> <br>
>>>> Hi Guys,<br>
>>>> <br>
>>>> Has anyone noticed a huge increase in smtp slamming recently?<br>
>>>> <br>
>>>> We have a busy mail cluster that has about 80k users. In the last 10 days or so<br>
>>>> we've seen a huge increase in IPs slamming the mail servers. The really odd<br>
>>>> thing is that it happens a few times a day and it's really intensive. Mostly the<br>
>>>> traffic hops off of RBL lookups. As an experiment today I moved 8 domains<br>
>>>> MX records to a stand alone Postfix box with just <a href="http://zen.spamhaus.org">
zen.spamhaus.org</a><br>
>>>> configured on it.<br>
>>>> <br>
>>>> The results are _insane_, a snippet from just today.<br>
>>>> <br>
>>>> Per-Hour Traffic Summary<br>
>>>> ------------------------<br>
>>>> time received delivered deferred bounced rejected<br>
>>>> --------------------------------------------------------------------<br>
>>>> <br>
>>>> 1000-1100 12 0 0 19 1776<br>
>>>> 1100-1200 26 1 0 112 2851<br>
>>>> 1200-1300 25 5 0 54 3256<br>
>>>> 1300-1400 66 1 0 200 13509<br>
>>>> 1400-1500 241 0 0 501 61974<br>
>>>> 1500-1600 229 3 0 520 55902<br>
>>>> 1600-1700 38 1 0 74 3750<br>
>>>> 1700-1800 197 2 0 441 47213<br>
>>>> 1800-1900 302 3 0 638 77602<br>
>>>> 1900-2000 134 6 0 248 38728<br>
>>>> 2000-2100 23 1 0 63 4482<br>
>>>> 2100-2200 169 4 0 216 2786<br>
>>>> <br>
>>>> Is anyone else seeing this?<br>
>>>> <br>
>>>> Cheers,<br>
>>>> <br>
>>>> Paul<br>
>>>> <br>
>>>> Paul Kelly<br>
>>>> Technical Director<br>
>>>> Microsoft Certified Partner<br>
>>>> Blacknight Internet Solutions ltd<br>
>>>> Hosting, Colocation, Dedicated servers<br>
>>>> IP Transit Services<br>
>>>> Tel: +353(0)599183072<br>
>>>> Lo-call: 1850 929 929<br>
>>>> DDI: +353 (0) 59 9183091<br>
>>>> <br>
>>>> e-mail: <br>
>>>> <a href="mailto:paul@blacknight.com">paul@blacknight.com</a><br>
>>>> <br>
>>>> web: <br>
>>>> <a href="http://www.blacknight.com">http://www.blacknight.com</a><br>
>>>> <br>
>>>> <br>
>>>> Blacknight Internet Solutions Ltd,<br>
>>>> Unit 12A,Barrowside Business Park,<br>
>>>> Sleaty Road,<br>
>>>> Graiguecullen,<br>
>>>> Carlow,<br>
>>>> Ireland<br>
>>>> <br>
>>>> Company No.: 370845<br>
>>>> <br>
>>>> --<br>
>>>> MailScanner mailing list<br>
>>>> <br>
>>>> <a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
>>>> <a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
>>>> <br>
>>>> <br>
>>>> Before posting, read <br>
>>>> <a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a><br>
>>>> <br>
>>>> <br>
>>>> Support MailScanner development - buy the book off the website!<br>
>>>> <br>
>> <br>
>> -- <br>
>> Ing. Sergio Rabellino<br>
>> <br>
>> Università degli Studi di Torino<br>
>> Dipartimento di Informatica<br>
>> ICT Services Director<br>
>> Tel +39-0116706701 Fax +39-011751603<br>
>> C.so Svizzera , 185 - 10149 - Torino<br>
>> <br>
>> <logo.jpg><br>
>> -- <br>
>> MailScanner mailing list<br>
>> <a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
>> <a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
>> <br>
>> Before posting, read <a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a><br>
>> <br>
>> Support MailScanner development - buy the book off the website! <br>
> <br>
> -- <br>
> MailScanner mailing list<br>
> <a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
> <a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
> <br>
> Before posting, read <a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a><br>
> <br>
> Support MailScanner development - buy the book off the website! <o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>