Re: IDS engines put this together

[bradipo () xmission com (Andy Bradford)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
Thus said "Marcus J. Ranum" on Mon, 12 Jun 2000 14:13:04 EDT:

> You can have an NFR generate an alert if there are more
> than a certain number of RCPT:s for a message. But I
> think it'll be hard to come up with a perfect algorithm
> for determining spam from desirable bulk mailings. That's
> the real trick. We have all the other pieces of the puzzle
> except that one.

There is always the tarpit solution... :-)  After a determined number 
of RCPT TO: are received it starts taking forever to return the ACK for 
each one.  (not really an ACK, but you know what I mean).

Andy

-- 
[-----------[system uptime]--------------------------------------------]
  9:03pm  up 15 days,  4:14,  3 users,  load average: 1.15, 1.21, 1.22