OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: smart anti flood tools
From: Ralf Hildebrandt (R.Hildebrandttu-bs.de)
Date: Wed Feb 02 2000 - 09:56:10 CST

On Wed, Feb 02, 2000 at 04:41:09PM +0100, Terje Elde wrote:

> If you want to set a limit, it might make sense to use the From header,
> because even if it's a single dialup link sending all the mail, it'll come
> from different people, thus you won't shut down that IP, which you might
> do if you were to go by connected IP.

The From: header is NOT logged.
The envelope-from is logged, though.
 
> Then again, a spammer could easily set his From's to random people.

This way he'd lose his advantage of submitting one message with a giant list
of recipients. That would be a stupid spammer.

> And what about mailing lists? When a offline company sends a mail to a
> mailing list with 6000 of it's clients, and it goes online to send them
> all...

Nah. Normally the mailserver that the offline company uses would do the
delivery -- ONE message arrives that would be delivered to the 6000
recipients. 

-- 
Ralf Hildebrandt <R.Hildebrandttu-bs.de> www.stahl.bau.tu-bs.de/~hildeb
When your manager gives you a folder full of assignments, try 
throwing it away.