Bookmark this on Delicious
What is SpamCheetah?
SpamCheetah is a LiveCD for spam control. It is useful when you run a mail server and you want to save bandwidth costs since SpamCheetah is a network level spam filter. SpamCheetah liveCD/liveDVD also comes with an option to install SpamCheetah to a hard disk(IDE/SCSI/SATA), USB pendrive, Disk On Memory module(DOM) or an external USB hard disk. However SpamCheetah is a Read Only OS instance and it never writes anything to persistent storage. This makes SpamCheetah incredibly fast and you also save on write cycles in case you run it off a USB stick.
There is documentation on installing SpamCheetah on to a disk and installing SpamCheetah spam filter into your network here.
How is this spam control technique superior?
Conventional spam control techniques rely on content scanning in one way or other. Statistical filtering/content scanning though effective can result in false positives. Moreover by the time corrective action is taken it is too late. The network resources and storage space of mail servers already become a victim of unwanted mail traffic. Moreover there is also the risk of losing valid e-mails due to false positives.
Content scanning relies on heuristics as well as certain combination of keywords occurring in the e-mail body. This approach by its very nature is error prone and can sometimes be a bit off depending upon the textual patterns of e-mails found in a given set. This is what leads to errors in decision since it all depends upon probability and statistics.
Does SpamCheetah lose legitimate mail?
False positives or legitimate mails being misclassified as spam is a problem caused by content scanning. Since SpamCheetah does no content scanning SpamCheetah can never lose e-mail.
However SpamCheetah does rely on blacklisting of IP addresses that send mail. So if a legitimate mail sender IP is blacklisted then theoretically you could lose mails sent from that IP address. But e-mails are retried by MTAs that adhere to RFC standards. The blacklisting done by SpamCheetah is also valid only for 24 hours. So this seldom occurs in practice.
In short, you shall never lose a valid e-mail with SpamCheetah. However there can be a delay of a few hours.
Does SpamCheetah have any real life exposure? Has it ever been deployed in a real life environment?
SpamCheetah has been working successfully in a very high pressure environment in which it handles close to 20,000 legitimate e-mails in a day. It has a proven track record of stopping nearly all spam and also reliability.
Since it is a hardware product, the stability of the network element is guaranteed by Gayatri Hitech. We provide support for both the hardware and software running inside SpamCheetah.
Once the spammers identify the technique used, will they be able to bypass SpamCheetah?
SpamCheetah's method of OpenBSD greylisting is adaptive and it can fight new spammer patterns. It does not require any update of the software engine; only the latest blacklist databases independently maintained worldwide.
If the spammer keeps the TCP connection open long enough to let spam pass through will SpamCheetah be able to stop such spam?
Spam control is similar to computer security since both rely on making the attack more difficult than the attacker has resources for.
Spammers' business model does not allow RFC compliance. So SpamCheetah works.
When a spammer crosses multiple links to reach you, will you be able to identify it? Conversely will legitimate mail be lost?
OpenBSD greylisting only relies on the IP address that sends us mail. It is not possible to thwart its mechanism by using bounce, backscatter or other methods.
No matter how the mail is hopped around, eventually it is sent to us by only one IP address. Consequently legitimate RFC compliant mailers will always be able to send us individual e-mails.
Will I be able to know how many spam mails were stopped by SpamCheetah?
Since SpamCheetah's technology never allows spam to even enter our network, it is impossible to figure out how many spam messages were actually stopped.
SpamCheetah does not do mail filtering. In fact SpamCheetah does not even have the capability to do content scanning. It only categorizes senders and arrests the bot-net spew.
Consequently using SpamCheetah's technology makes it impossible to know how much of spam traffic is getting stopped.
Does SpamCheetah require manual intervention or maintenance?
All of Gayatri Hitech's products are aimed at zero maintenance. SpamCheetah is no different. We do provide a web interface to manually whitelist IP addresses but that is not recommended practice.
SpamCheetah takes spam control to a totally different level. Once you try it you will know for yourself.
