Re: [exim] Rate Limiting?

Tony Finch wrote:

> > I'm doubtful that even a University is so uniform that sheer volume is
> > a sure fire indicator of wickedness
>
> You are right that I'm probably being optimistic, which is why I intend
> to do plenty of measurement before starting enforcement. Also, I'm not
> planning to use rate limiting as the sole or even the principle means of
> detecting bad behaviour, but mainly as an emergency backstop to protect
> against spewing hosts.


If I remember correctly, someone once posted a paper correlating the
volume sent with regards to invalid recipients and recipients per message,
and also to the general usage patterns seen from each client. It was
literally a three to four pronged approach, working on cumulative data by
building the info from the logs. ( BTW, if I am drifting off topic, let me
know. I have only lightly perused the thread since it started :) Whilst it
is a slow to build information scenario, it does seem to make a good long
term strategy. For subscribe, spam and run type situations, obviously not
much use due to the limited timespan.

Just thought the idea may be something to chew on.


Matt