[SA-exim] FYI: Tarpit stats

[Brian Kendig]

I was curious as to how effective my tarpit was being, so I grabbed my 
mail server log files and did some analysis on 'em.

1160 spammers escaped my tarpit (either by bailing out or waiting for 
the full time) during the past ten full days (January 15 through 25).  
Here's how long they spent in 'penalty hold':

950 were still stuck after half a minute
934 after a minute
918 after two minutes
864 after five minutes
848 after ten minutes
686 after twenty minutes
670 after half an hour
604 after an hour
559 after two hours
510 after four hours
494 at half a minute before five hours
348 at half a minute after five hours
307 at eight hours
243 at sixteen hours
192 at one day
129 at two days
  91 at three days
  66 at four days (345600 seconds, my limit, so I dumped the rest of 'em 
now)

What this means is that roughly one out of every eighteen spammers is 
willing to sit around infinitely (four days is practically an 
infinity!) until I dump him.

Note that about 150 of them disconnect right around five hours.  Looks 
like some spammer software is using that as a timeout.

At this moment I've got 39 spammers in my tarpit.  I don't think I've 
ever had more than sixty or so simultaneously in the pit, even with the 
long delay and even though my server's configured to be able to handle 
200 at once.

I'm putting up these stats in case anyone's interested in them.  :)


  ____    |\/|                 Brian Kendig   Set your priorities right.
  \  /\   / ..__.    brian at enchanter net   No one ever said on his
   \/  \__\   _/   http://www.enchanter.net/  death bed, "Gee, if I'd
    \__   __  \_      Be insatiably curious.  only spent more time at
       \____\___\           Ask "why" a lot.  the office."