Tarpit (networking) - Mixed SMTP-IP Level Tarpits

Mixed SMTP-IP Level Tarpits

A server can determine that a given mail message is spam, e.g. because it was addressed to a spam trap, or after trusted users' reports. The server may decide that the IP address responsible for submitting the message deserves tarpitting. Cross-checking against available DNSBLs can help avoiding to include innocent forwarders in the tarpit database. A daemon exploiting Linux libipq can then check the remote address of incoming SMTP connections against that database. SpamCannibal is a GPL software designed around this idea; Stockade is a similar project implemented using FreeBSD ipfirewall.

One advantage of tarpitting at the IP level is that regular TCP connections handled by an MTA are stateful. That is, although the MTA doesn't use much CPU while it sleeps, it still uses the amount of memory required to hold the state of each connection. On the opposite, LaBrea-style tarpitting is stateless, thus gaining the advantage of a reduced cost against the spammer's box. However, it has to be noted that making use of botnets, spammers can externalize most of their computer-resource costs.