Re: connections with DATA followed by QUIT

On Wed, Aug 20, 2003 at 09:32:41PM -0700, Ask Bjørn Hansen wrote:
> On Wednesday, Aug 20, 2003, at 20:40 America/Los_Angeles, Jim Winstead 
> wrote:
> >addresses to other (single) random recipients where the DATA is 
> >followed
> >immediately by QUIT. (so nothing ends up getting queued, and a '451
> >Incomplete Data' is returned.)
> 
> FWIW, I noticed the same thing in the perl.org mx logs.    Didn't look 
> any closer though; I just wrote it off to Bad Virus Programmer (ha; 
> like there's such a thing as "Good Virus Programmer").

indeed. i just implemented something that dumps a list of ips for which
that behavior has been seen in the last thirty minutes, and rebuilds the
tcpserver cdb database with 'deny' rules for them, and stuck that in a
once-a-minute cronjob. seems to have pretty much slowed it down so the
number of concurrent connections is back below the max.

jim

• connections with DATA followed by QUIT by Jim Winstead
• Re: connections with DATA followed by QUIT by Ask Bjørn Hansen
• Re: connections with DATA followed by QUIT by Jim Winstead