Re: [Sqlgrey-users] Feature suggestion: kind of tarpitting

[Michel B. <mi...@bo...>]

Lionel Bouton a =E9crit :
>
> We could refine the tarpiting [...]

I was thinking of another way to make its decisions more "dynamic" :

Suppose "n" is the limit of number of entries waiting in "connect" for a
given IP, at which we stop accepting new entries (we start "tarpitting").

Now suppose we stop accepting new entries ONLY if there are more than "n"
entries in connect for this IP, AND LESS than "n" entries for this IP in
"from_awl", AND NO entry for this IP in "domain_awl".

This will make sure that "big legitimate senders" don't get hurt by the
system, because as soon as they can either make it to "domain_awl" or hav=
e
retransmitted properly at least one full set of "n" messages, then
tarpitting stops for them, and "connect" will then accept any number of
entries from them.

Doesn't this look better ? Still rather simple, with little needed
configuration, and should adapt fair enough to traffic characteristics by
itself...

--=20
Michel Bouissou <mi...@bo...> OpenPGP ID 0xDDE8AC6E
Appel de 200 Informaticiens pour le NON au Trait=E9 Constitutionnel
Europ=E9en: http://www.200informaticiens.ras.eu.org