On Wed, Aug 20, 2003 at 09:32:41PM -0700, Ask Bj�rn Hansen wrote: > On Wednesday, Aug 20, 2003, at 20:40 America/Los_Angeles, Jim Winstead > wrote: > >addresses to other (single) random recipients where the DATA is > >followed > >immediately by QUIT. (so nothing ends up getting queued, and a '451 > >Incomplete Data' is returned.) > > FWIW, I noticed the same thing in the perl.org mx logs. Didn't look > any closer though; I just wrote it off to Bad Virus Programmer (ha; > like there's such a thing as "Good Virus Programmer").
indeed. i just implemented something that dumps a list of ips for which that behavior has been seen in the last thirty minutes, and rebuilds the tcpserver cdb database with 'deny' rules for them, and stuck that in a once-a-minute cronjob. seems to have pretty much slowed it down so the number of concurrent connections is back below the max. jim
