Re: Barracuda Networks Spam Firewall

2004-05-17 Thread Jared B. Reimer

Did you not receive some basic support from them during your
evaluation? A perceived 90% drop in performance is pretty significant
and I'd imagine that they'd be interested in helping to determine the
cause.
Sadly, they have not responded to my email on the topic, sent four days ago.
However, someone unrelated to the company emailed me off-list saying that 
basically this is a known flaw in the product with back-end systems like 
qmail that asynchronously bounce mail for invalid recipients.  See below quote:

We had this problem when our inbound-smtp server ( the server the 
barracuda is dumping mail to) was accepting all RCPT TOs:   As a result 
dictionary attacks were getting through and creating 'unique recipients' 
on the Barracuda.   As soon as I fixed my mail server to reject with a 220 
error on bogus RCPT TOs  the problem cleared up.
This is a pretty serious flaw IMHO, if it is (in fact) true.  qmail isn't 
the only mailer that behaves this way.  It looks like they may have tried 
to kludge their way around this with LDAP in the case of MS Exchange, which 
also does asynchronous bouncing of undeliverable mail IIRC.

-- Jared



Re: Barracuda Networks Spam Firewall

2004-05-17 Thread Jared B. Reimer
We have done an eval of this same product (model 400).  It is very cool in 
virtually every regard except one: performance.  We were facing 1+ hour 
mail delays (!) through the device when pumping less than 1,000,000 
messages per day through it.   Given that they claim it can handle ten 
times that much, I am left wondering what happened.  Very disappointing in 
that regard; the eval unit is being shipped back as a result.  -- Jared

At 11:35 AM 5/17/2004, Claydon, Tom wrote:

Doing evaluations on anti-spam, anti-virus solutions, and ran across
this:
http://www.barracudanetworks.com/
Looks like a good box -- even won an Editor's Choice award from Network
Computing recently.
Does anyone on list have any experience with these boxes? If so, how are
they with false positives, quarantine capabilities, etc?
Thanks,
Tom Claydon
Dobson Telephone

##  Jared B. Reimer <[EMAIL PROTECTED]>
##  CTO / The River Internet Access Co.
##  +1 (877) 88-RIVER x170 ||  http://www.theriver.com/


Increase in traffic to/from DSL subs since August?

2003-11-20 Thread Jared B. Reimer
Greetings.

Another independent ISP operator and I have noticed a pretty significant 
increase in traffic to and from our broadband (DSL) subscribers since 
August.  It's been a fairly steady uptick, at least in my case, resulting 
in a doubling of overall average traffic to/from these folks since then.

Have others seen a similar trend?  Any thoughts as to what the cause may 
be?  Our best guess a virus/worm, possibly being used as a spam relay or 
other proxy at this point...

Many thanks,

-- Jared