Tumbleweed shines light on 'dark traffic'
It eats resources and admins know little about it, says vendor.
By John Dunn | Published: 16:42, 08 February 2005
Anti-spam vendor Tumbleweed has announced its MailGate Edge messaging security firewall with the claim that it can protect companies from the hidden scourge of "dark traffic".
Designed to counter a range of rogue events, the server will analyse the source of a message, its frequency, and whether it was being sent to a legitimate e-mail address to work out whether it should be accepted or rejected.
Normally, messaging protection relies on inspecting the e-mail itself to see whether it qualifies as spam or non-legitimate, but the company says this only stops a percentage of problem traffic. The traffic analysis technique, by contrast, had been able to identify between 30 and 70 percent of traffic as rogue when tested with trial customers in the US and Europe.
Rogue or dark traffic included - in addition to spam - directory harvest attacks (DHAs), e-mail denial-of-service floods, and malformed packets. All of these could eat resources on a network despite the fact that they were commonly ignored by administrators unaware that a network was under assault.
DHAs, in particular, are used by spammers to test for genuine email addresses by flooding a domain with guessed email addresses to see which were not bounced. These are then added to spam listings for future attacks via e-mail.
“Once you get to scanning things with filters you are too late. The aim of this is to get there before that point,” said Dave Brunswick, Tumbleweed’s European technical director.
According to Brunswick, DHAs tended to come from a small number of machines or IP addresses and to contain a high number of guessed e-mail addressees, which made them easy to spot. Likewise, zombie attacks could be countered by dropping connections in a logical manner rather than simply cutting off the e-mail service completely.
As ever, the success of such a system will depend on its ability to deal with tricky problems such as DoS attacks using widely dispersed client zombies. If these are sending to legitimate addresses then the company’s conventional anti-spam systems would, presumably, be required in addition to the MailGate Edge.
The MailGate Edge has a list price starting at £3,900 ($5,000).
