Spam Filter ISP Forums : spambot attack & max incomming reached https://www.logsat.com/spamfilter/forums/ Mon, 10 Aug 2026 03:58:38 +0000 Fri, 15 Oct 2010 16:31:11 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6881 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[spambot attack & max incomming reached : If the zipped logfile is smaller...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6881&PID=13833&title=spambot-attack-max-incomming-reached#13833 Author: LogSat
Subject: 6881
Posted: 15 October 2010 at 4:31pm

If the zipped logfile is smaller than 8MB, you can simply email it to us at support at logsat dot com. If not, I'll be sending you a PM shortly with our FTP info to upload the file. Please also let us know the to/from email addresses that are getting the NDR (a copy of the NDR would also help). If you happen to know the IP of the remote server, that will help to of course.]]> Fri, 15 Oct 2010 16:31:11 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6881&PID=13833&title=spambot-attack-max-incomming-reached#13833 <![CDATA[spambot attack & max incomming reached : I have been monitoring a bit more...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6881&PID=13832&title=spambot-attack-max-incomming-reached#13832 Author: Pierre
Subject: 6881
Posted: 15 October 2010 at 11:48am

I have been monitoring a bit more and I can see that the spambot attacks are more frequently and also last longer. So I assume that legitimate mail does not get an NDR on the first connection attempt, but later one, when it gives up. But strange that they never fail over to one of the other MX servers. Those are not busy at all at that time.

It would be great if you could take a look at f.e. yesterdays log file. How do I send it over?


Edited by Pierre - 15 October 2010 at 11:49am]]> Fri, 15 Oct 2010 11:48:57 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6881&PID=13832&title=spambot-attack-max-incomming-reached#13832 <![CDATA[spambot attack & max incomming reached : Pierre,That is odd (the NDR)....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6881&PID=13828&title=spambot-attack-max-incomming-reached#13828 Author: LogSat
Subject: 6881
Posted: 14 October 2010 at 7:49pm

Pierre,

That is odd (the NDR). When the max connection limit is reached, SpamFilter abruptly terminates the connection, sending a "421 Too many connections on the server" error first. This should cause the remote SMTP server to retry sending the email for a reasonable number of times, absolutely not to send back an NDR to the sender right away. If they send an NDR without retrying at least a few times (the RFC 5321 does not specify a minimum threshold), they're violating RFC. Furthermore, in the retry, they should be attempting to connect to your secondary MX records if present.
If you have a specific sender for which you experience this behavior, you may want to let them know of the problem. If there's multiple such cases with multiple senders, are you certain that they are indeed not trying to connect to the secondaries (or retrying to send the email thru SpamFilter at a later time)? We'd be happy to examine SpamFilter's activity logfile for you if you'd like to look for abnormalities.
]]> Thu, 14 Oct 2010 19:49:27 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6881&PID=13828&title=spambot-attack-max-incomming-reached#13828 <![CDATA[spambot attack & max incomming reached : We have 3 relay servers we use...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6881&PID=13827&title=spambot-attack-max-incomming-reached#13827 Author: Pierre
Subject: 6881
Posted: 14 October 2010 at 10:31am

We have 3 relay servers we use for incomming and outgoing mail.

From time to time one of them is under attack by spambots and then the max number of concurrent incomming smtp connections (currently set at 50) is reached.

What then happens is that new connection attempts are accepted, but dropped immediately and therefore that legitimate new connection attempts get a "smtp connection error" NDR.

I would think that ones the max concurrend incoming connections are reached, logsat would refuse any new connection and that legitimate connection attempts would then fail over to a secondary relay server based on the mx config.

Is there a way to configure logsat to stop handling incoming request once the max is reached or is there another way to solve this issue?



Edited by Pierre - 15 October 2010 at 11:42am]]> Thu, 14 Oct 2010 10:31:59 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6881&PID=13827&title=spambot-attack-max-incomming-reached#13827