DoDomainIP would be nice but it does not work too well. As you can see below it works very rarely. Basicly its not, while it should catch so many IPs!
root@sv1 [/usr/assp]# cat assp.cfg|grep DoDomainIP DoDomainIP:=1 root@sv1 [/usr/assp]# cat assp.cfg|grep maxSMTPdomainIP maxSMTPdomainIP:=10 maxSMTPdomainIPExpiration:=7200 maxSMTPdomainIPLD:=1 maxSMTPdomainIPWL:=yahoo.com|hotmail.com|gmail.com root@sv1 [/usr/assp/logs]# cat maillog.txt|grep 'of ips per domain'|tail -n 10 Nov-05-13 17:27:43 38366-82065 [IPperDomain] 190.235.182.47 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 17:27:45 38366-82068 [IPperDomain] 190.235.182.47 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 17:27:46 38366-82079 [IPperDomain] 190.235.182.47 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 18:54:54 38367-92203 [IPperDomain] 190.237.154.229 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 18:55:00 38367-92216 [IPperDomain] 190.190.141.73 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 18:55:02 38367-92219 [IPperDomain] 190.190.141.73 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 19:29:25 38367-95213 [IPperDomain] 190.239.197.42 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 19:30:30 38367-95306 [IPperDomain] 2.145.109.86 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 19:42:49 38367-97978 [IPperDomain] 190.238.249.61 <[email protected]> '@google.com' passed limit(10) of ips per domain; Nov-05-13 20:28:53 38367-01924 [IPperDomain] 183.91.80.50 <[email protected]> '@google.com' passed limit(10) of ips per domain; root@sv1 [/usr/assp/logs]# cat maillog.txt|grep '@google.com'|tail -n 30|awk '{print $4}'|uniq -c 1 188.186.84.29 1 [SpoofedSender] 2 188.186.84.29 1 [SpoofedSender] 2 94.183.41.92 1 202.29.239.113 2 202.84.75.242 1 87.76.50.237 2 118.98.197.170 1 181.64.158.166 1 117.241.0.194 1 59.177.235.197 1 147.30.39.222 1 200.35.37.4 1 87.76.50.237 1 2.180.138.43 1 110.164.71.145 1 201.230.184.55 1 117.241.0.194 1 202.53.80.218 2 2.184.221.41 1 200.35.202.156 1 181.66.116.195 1 95.58.102.125 1 124.158.74.2 root@sv1 [/usr/assp/logs]# cat maillog.txt|grep '@google.com'|tail -n 30 Nov-06-13 05:31:21 38371-00645 202.53.80.218 <[email protected]> to: [email protected] disconnected (1 seconds); Nov-06-13 05:31:22 38371-00647 2.184.221.41 <[email protected]> to: [email protected] recipient delayed: [email protected]; Nov-06-13 05:31:22 38371-00647 2.184.221.41 <[email protected]> to: [email protected] disconnected (2 seconds); Nov-06-13 05:31:23 38371-00646 200.35.202.156 <[email protected]> to: [email protected] disconnected (8 seconds); Nov-06-13 05:31:27 38371-00650 181.66.116.195 <[email protected]> to: [email protected] disconnected (3 seconds); Nov-06-13 05:31:36 38371-00658 95.58.102.125 <[email protected]> to: [email protected] disconnected (6 seconds); Nov-06-13 05:31:39 38371-00664 124.158.74.2 <[email protected]> to: [email protected] disconnected (1 seconds); Nov-06-13 05:31:47 38371-00671 202.47.64.70 <[email protected]> to: [email protected] disconnected (5 seconds); Nov-06-13 05:31:50 38371-00672 119.63.83.37 <[email protected]> to: [email protected] recipient delayed: [email protected]; Nov-06-13 05:31:50 38371-00672 119.63.83.37 <[email protected]> to: [email protected] disconnected (1 seconds); Nov-06-13 05:31:53 38371-00673 181.18.28.140 <[email protected]> to: [email protected] recipient delayed: [email protected]; Nov-06-13 05:31:53 38371-00673 181.18.28.140 <[email protected]> to: [email protected] disconnected (2 seconds); Nov-06-13 05:31:56 38371-00676 190.238.166.45 <[email protected]> to: [email protected] disconnected (2 seconds); Nov-06-13 05:31:56 38371-00679 95.56.157.17 <[email protected]> to: [email protected] disconnected (4 seconds); Nov-06-13 05:31:56 38371-00680 95.56.157.17 <[email protected]> to: [email protected] disconnected (4 seconds); Nov-06-13 05:32:02 38371-00710 178.61.193.159 <[email protected]> to: [email protected] disconnected (3 seconds); Nov-06-13 05:32:02 38371-00711 178.61.193.159 <[email protected]> to: [email protected] disconnected (3 seconds); Nov-06-13 05:32:08 38371-00712 37.218.153.138 <[email protected]> to: [email protected] disconnected (3 seconds); Nov-06-13 05:32:10 38371-00713 118.98.197.170 <[email protected]> to: [email protected] disconnected (2 seconds); Nov-06-13 05:32:11 38371-00715 117.3.177.253 <[email protected]> to: [email protected] recipient delayed: [email protected]; Nov-06-13 05:32:12 38371-00715 117.3.177.253 <[email protected]> to: [email protected] disconnected (2 seconds); Nov-06-13 05:32:12 38371-00714 122.2.22.242 <[email protected]> to: [email protected] recipient delayed: [email protected]; Nov-06-13 05:32:12 38371-00714 122.2.22.242 <[email protected]> to: [email protected] disconnected (2 seconds); Nov-06-13 05:32:14 38371-00718 117.3.177.253 <[email protected]> to: [email protected] recipient delayed: [email protected]; Nov-06-13 05:32:14 38371-00718 117.3.177.253 <[email protected]> to: [email protected] disconnected (2 seconds); Nov-06-13 05:32:15 38371-00717 117.218.108.23 <[email protected]> to: [email protected] recipient delayed: [email protected]; Nov-06-13 05:32:15 38371-00717 117.218.108.23 <[email protected]> to: [email protected] disconnected (3 seconds); Nov-06-13 05:32:18 38371-00721 87.76.50.237 <[email protected]> to: [email protected] disconnected (1 seconds); Nov-06-13 05:32:23 38371-00725 82.200.205.101 <[email protected]> to: [email protected] recipient delayed: [email protected]; Nov-06-13 05:32:23 38371-00725 82.200.205.101 <[email protected]> to: [email protected] disconnected (1 seconds); ------------------------------------------------------------------------------ November Webinars for C, C++, Fortran Developers Accelerate application performance with scalable programming models. Explore techniques for threading, error checking, porting, and tuning. Get the most from the latest Intel processors and coprocessors. See abstracts and register http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
