North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Internet email performance study

  • From: Crist Clark
  • Date: Thu Apr 28 18:59:16 2005

Brad Knowles wrote:

At 3:05 PM -0700 2005-04-28, Crist Clark wrote:

 http://www.albury.net.au/netstatus/derouted.html

 No, it doesn't. Please read their paper. In the paper and as he stated
 again in the response above, their definition of a "loss" requires the
 message to be delivered successfully in the first place. The anti-spam
 measure described in the above URL causes the remote MTA to not accept
 mail at all from the blocked source. This would not be counted as a loss
 in their methodology, but possibly as an "error."

Yeah, but there are plenty of other places that will otherwise do the same sort of thing, but instead of de-routing the address, they will silently discard all messages from that IP address.

AOL is one known big offender in that area, because I helped set up the bounce processing system at AOL that did exactly that.


So, while albury.net themselves would not cause the kinds of results that are being seen, they do have an otherwise good explanation for the kinds of things that many sites tend to do when faced with excessive probes or other activity that they believe is likely to be an indication of spam or something that is spam-related.
It's possible. Those with very sensitive threasholds that would pick up one
email every fifteen minutes as a scan could produce drop rates between zero
and one. Assuming the threashold detection is a well defined algorithm,
however, one would expect the drops to be deterministic, e.g. after one
hour (four sets) of attempts, they fall into black hole, come out after one
hour, two hours, eight hours, or a day, and then the whole thing repeats.

The authors couldn't find patterns, but that does not mean that there are
not any patterns to find. I considered looking at their raw data myself
until I saw it was a 100+ MB gzipped tarball. Anyone can test these kinds
of theories if they are willing to download and slog through the data.
--
Crist J. Clark                               crist.clark@globalstar.com
Globalstar Communications                                (408) 933-4387