Want throttle or add small delay/pause to slow down SMTP connections

Question

Hi,&nbsp;&nbsp;My basic question is once I know I want to temporarily "block" 
"delay" or "pause" a connection to "slow" down a TCP (actually SMTP) connection a fixed period of time say between 100ms to 2000ms - how do I 
do it in an iRULE ?&nbsp;

&nbsp;Why I want to do this&nbsp;
&nbsp;I wish to implement via iRULEs a "teergube" (definition below), which would do one of the following a), b), or c) in all cases I do not know to correct why to "pause", "delay" or "block" the data transfer. &nbsp;
&nbsp;I would want to do either a), b) or c).  I definitely prefer c)  but every approach requires that I understand how solve the question above.&nbsp;
&nbsp;a) on each SMTP connection apply a finite delay when accepting the connection
&nbsp;    such as 500ms (1/2 a sec).&nbsp;
&nbsp;b) on each packet (or every N bytes in a SMTP connection) apply a finite delay
&nbsp;    better yet after 50K bytes start applying the finite delay.&nbsp;
&nbsp;c) inspect the SMTP data and for connection inspect the payload such that 
&nbsp;    each time match the following HELO or EHELO (pipelining) I could be smart
&nbsp;    about injected delays and prevent 'spammers' from hogging bandwidth.  As an
&nbsp;    example.&nbsp;
&nbsp;     1.   if { [string match -nocase "MAIL FROM:*" [TCP::payload]] } {
&nbsp;            block or pause the connection a fixed finite delay like 200ms
&nbsp;            on occurrence 2-N this lets the first message go fast.&nbsp;
&nbsp;     2.   if { [string match -nocase "RCPT TO:*" [TCP::payload]] } { 
&nbsp;            block or pause the connection a fixed finite delay like 100ms
&nbsp;            on occurrence 4-N this lets the first message go fast to a 
&nbsp;            limited number of users.&nbsp;

&nbsp;Thanks in Advance&nbsp;
&nbsp;Other &nbsp;
&nbsp;Information about what a "teergube" is - basically it seems like a way to "slow" done spammers and tie up their resources while eliminating spam:&nbsp;
&nbsp;    http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html
&nbsp;    http://serverfault.com/questions/60141/is-there-any-point-to-teergrubing-anymore&nbsp;&nbsp;&nbsp;

hoolio · Answer

Hi Jon, 
&nbsp;  
&nbsp; As TMM is single threaded, if you could add delay to connections, it would affect all connections that the TMM instance is handling.  So there isn't a practical way to accomplish exactly what you've described.  I wonder if you could use rate classes to do this to some extent though: 
&nbsp;  
&nbsp; http://devcentral.f5.com/wiki/default.aspx/iRules/rateclass 
&nbsp;  
&nbsp; Aaron

hamish · Answer

What SMTP server do you use? postfix (www.postfix.org) will handle this for you... But because it knows about your users etc, it only slows down connections for things that are more likely to be spammers rather than slowing down legitimate traffic... 
&nbsp;  
&nbsp; (Slowing down ALL connections will just annoy people). However if you snoop the result codes from a generic SMTP server, you could (As hoolio suggests) use rate shaping to drop the bandwidth to some painfully low level (And send a nice long status message telling the admin what you're doing, and how to contact you if it's a mistake). 
&nbsp;  
&nbsp; H

jon_strabala_46 · Answer

Aaron,&nbsp;
  &nbsp;
 &gt; As TMM is single threaded, if you could add delay to 
connections, it would affect all connections &nbsp;
&gt; that the TMM instance is handling.  So there isn't a practical way 
to accomplish exactly what 
you've &nbsp;
&gt; described.&nbsp;
&nbsp;What about pausing while processing a connections data in a later iRULE clause CLIENT_DATA  e.g. after a  TCP:collect or is this also single threaded - just curious.&nbsp;
&nbsp;I know I could just redirect the connection into a "tar pit" e.g. a 'C' based SMTP proxy that limits the bandwidth (and also records / logs information about the spammer) but thought that maybe the F5 could do it all.&nbsp;
&nbsp;&gt; I wonder if you could use rate classes to do this to 
some extent though: &nbsp;
  &gt;&nbsp;
&gt; &nbsp;
&nbsp;I was just hoping that there was something like "yeild( millisecs)", so I will look into the applying a rate class and only to 'spamming connections'&nbsp;
&nbsp;Hamish&nbsp;
&nbsp;I do indeed understand that postfix and sendmail have extensive options that can be used to do what I am attempting e.g. down spammers.  I also understand that I do not what to apply the slowdown to everyone.  &nbsp;
&nbsp;Please also understand that the F5 is used "backwards" for an Mobile ISP thus it fronts hundreds
 of different unknown types of mail servers (and of course none of them are under
 the ISP's control).  &nbsp;
&nbsp;My iRULE right now analyzes the connection frequency and pattern and pretty much knows which connection is a spammer - right now I drop all SMTP spam connect - but what I wanted to play with was slowing them down to a trickle.   According to Aaron (see first part of this reply) it seems like I have to use a rate class.&nbsp;
&nbsp;Thanks for your responses.&nbsp;
&nbsp;Jon Strabala&nbsp;

hamish · Answer

Ah... You're running in reverse... OK... No problems... 
&nbsp;  
&nbsp; Actually, I'm not sure you couldn't use the 'after' command to accomplish what you want...  
&nbsp;  
&nbsp; e.g. 
&nbsp;  
&nbsp; 
if () {
  after 500 {
    
    return
  }
}

return
 
&nbsp;  
&nbsp; So if we have a spammer, we execute the after command with a 500ms delay and then send a respons. But if we don't have a spammer we send the response immediately... 
&nbsp;  
&nbsp; Sorry... Pseudo code only today... 
&nbsp;  
&nbsp; H

Forum Discussion

SSO Login Update Coming to DevCentral

Kevin - June 2026 Featured F5er

Tyler - May 2026 Featured Member

Recent Discussions

UCS file migration on differing OS versions

qkview: revealing pool members & pools

ASM attack signatures not syncing between active and standby F5

Query on source IP preservation for syslog traffic through F5 virtual server

Hardware BIG-IP appliance reach EOSS, but the software version running on it not yet?