BTW, we CAN do "in the cloud" email traffic shaping - on EC2, ironically. But also on your own equipment if that's your preference.
Regards,
Ken
Ken:
Thanks for the info, but that still requires the domain owner to change
their MX records. I was wondering if there was something that could
literally be placed in the flow of traffic, like an FWSM in transparent
mode.
Frank
Ken:
Thanks for the info, but that still requires the domain owner to change
their MX records. I was wondering if there was something that could
literally be placed in the flow of traffic, like an FWSM in transparent
mode.
That probably depends a lot on the topology in question... Doing it on
'ethernet' is far different from doing it on T1 over ATM or
channelized oc-48... A Checkpoint FW can do this sort of thing with a
'security server' (though performance is certainly a question...).
I think you're also always stuck in a store-and-forward mode so 'on
the wire' isn't really helpful for SMTP, often you can't make a
decision about an email without getting a large portion of it down, so
snuffing connections mid-stream isn't going to help your email infra
very much 
-Chris
Source IP blocking makes up a large portion of today's spam arrest approach,
so we shouldn't discount the CPU benefits of that approach too quickly.
I'm not sure where today's technology is in regards for caching the first 1
to 10kB of a session....once enough information is garnered to block, issue
TCP RSETs. If it's good, free the contents of the cache.
Frank
Behalf Of Christopher Morrow
Source IP blocking makes up a large portion of today's spam arrest approach,
so we shouldn't discount the CPU benefits of that approach too quickly.I'm not sure where today's technology is in regards for caching the first 1
to 10kB of a session....once enough information is garnered to block, issue
TCP RSETs. If it's good, free the contents of the cache.
What's your interest in mopping up spam in the middle of the network? Usually spam is viewed as a leaf-node problem (much to the chagrin of receivers, actually).
Regards,
Ken
For the reason you stated, "much to the chagrin of receivers". Easier to
sell a service to customers downstream if it's being done in the network,
without MX changing.
Frank