Very Computer

by **Linux-Mik** » Fri, 31 Dec 2004 16:13:47

I'm trying to setup a test environment for two mail servers to receive
the exact same email in order to compare the two for spam detection
accuracy. I thought that a novel way to do this would be to implement
the following ipchains rules, but I don't know if ipchains can do what
I need it to...

For traffic coming in on port 25, accept the packet locally, untouched,
and deliver it to the SMTP Daemon. Additionally, take all data coming
in on Port 25 to my IP address (10.1.1.1) and send a copy of it out,
changing the destination IP address from 10.1.1.1 to 10.1.1.2 (the test
server).

The desired result is:

1) Not change the live mail server in any way that affects processing
of mail.
2) Final result to have two mail servers, one for users, and one for me
to play mad scientist with. Both servers receive the exact same email,
without passing through local MTA's and contaminating the headers.
Can I use ipchains to accomplish this?

by **p..** » Fri, 31 Dec 2004 18:45:21

> For traffic coming in on port 25, accept the packet locally, untouched,
> and deliver it to the SMTP Daemon. Additionally, take all data coming
> in on Port 25 to my IP address (10.1.1.1) and send a copy of it out,
> changing the destination IP address from 10.1.1.1 to 10.1.1.2 (the test
> server).

TCP utilises handshaking, acknowledgments, retransmission, window sizing and
all sorts of things that are not going to make any implementation of this
reliable.

Maybe you could either use a proxy that receives the mail and distributes
it to multiple servers, or just use something like rsync to keep the mail
spools on both systems identical.

Paul

by **Allen McIntos** » Sat, 01 Jan 2005 11:30:36

> For traffic coming in on port 25, accept the packet locally, untouched,
> and deliver it to the SMTP Daemon. Additionally, take all data coming
> in on Port 25 to my IP address (10.1.1.1) and send a copy of it out,
> changing the destination IP address from 10.1.1.1 to 10.1.1.2 (the test
> server).
> Can I use ipchains to accomplish this?

You can try, but I suspect that the TCP stack on 10.1.1.2 is going to
get seriously ticked off and decide not to play any more.

You might be better off grabbing the raw traffic and using some tool
(lots available) to reconstitute individual files.

by **ynotsso** » Sat, 01 Jan 2005 14:35:02

Quote:> 2) Final result to have two mail servers, one for users, and one for
> me to play mad scientist with. Both servers receive the exact same
> email, without passing through local MTA's and contaminating the
> headers.

Uh ... how are you going to receive mail without the use of MTAs?

--
use hotmail for email replies

by 7 » Sun, 02 Jan 2005 11:39:05

>> For traffic coming in on port 25, accept the packet locally, untouched,
>> and deliver it to the SMTP Daemon. Additionally, take all data coming
>> in on Port 25 to my IP address (10.1.1.1) and send a copy of it out,
>> changing the destination IP address from 10.1.1.1 to 10.1.1.2 (the test
>> server).

> TCP utilises handshaking, acknowledgments, retransmission, window sizing
> and all sorts of things that are not going to make any implementation of
> this reliable.

> Maybe you could either use a proxy that receives the mail and distributes
> it to multiple servers, or just use something like rsync to keep the mail
> spools on both systems identical.

> Paul

Also I would think that two separate servers are not going
get identical e-mail. The way spammers foil this type of
detection is to add random characters inside the mail and/or subject
headings etc when sening to different recipients.

Very Computer

Interesting ipchains Challenge

Interesting ipchains Challenge

Interesting ipchains Challenge

Interesting ipchains Challenge

Interesting ipchains Challenge

Interesting ipchains Challenge