Comments on: Using IP Block List Providers and the Connection Filter agent in Exchange 2007 http://www.allspammedup.com/2008/12/using-ip-block-list-providers-and-the-connection-filter-agent-in-exchange-2007/ Wed, 08 Feb 2012 21:54:46 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: Scott http://www.allspammedup.com/2008/12/using-ip-block-list-providers-and-the-connection-filter-agent-in-exchange-2007/comment-page-1/#comment-18518 Scott Wed, 08 Dec 2010 01:49:10 +0000 http://www.allspammedup.com/?p=240#comment-18518 Thank you for posting this article. I was fairly confident where to add my blicklist provider but I was not entirely sure until I came across this article. Thank you again Thank you for posting this article. I was fairly confident where to add my blicklist provider but I was not entirely sure until I came across this article. Thank you again

]]> By: Ed Fisher http://www.allspammedup.com/2008/12/using-ip-block-list-providers-and-the-connection-filter-agent-in-exchange-2007/comment-page-1/#comment-15613 Ed Fisher Tue, 26 Oct 2010 15:40:37 +0000 http://www.allspammedup.com/?p=240#comment-15613 Hi Mario, There are a couple of ways you can determine how many SMTP connections your server is currently working with. The queue viewer is a graphical tool in the Exchange Management Console. Go to the toolbox, and you will see the queue viewer. Since you are probably more interested in the raw number of sessions (as opposed to the other side) you can also use Perfmon to view this. Look for the counters for "MSExchangeTransport SmtpReceive" and "MSExchangeTransport SmtpSend." If you want to see how many DNS queries your server is running at any point in time, you can only use Perfmon counters if the DNS server service is installed on the machine. You probably don't have that service installed on your Exchange server, and your DNS server is probably already processing a ton of queries for other clients, so I would take a network trace on UDP 53 and just gather statistics that way. If your server processes both inbound and outbound mail, you will need to do some guesstimating to eliminate the DNS queries generated from sending mail, but I already mentioned that counter above. Just remember that your Exchange server's resolver cache will hold on to records resolved for the duration of the TTL, so round down to nearest random number unless clear your resolver cache frequently during the monitoring, or reduce the maximum TTL for caching to 1. · Start Registry Editor (Regedit.exe). · Locate the MaxCacheEntryTtlLimit value under the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters · On the Edit menu, click Modify. Type 1, and then click OK. · Quit Registry Editor. I don't recommend doing that, and since most systems I have dealt with send multiple emails to the same destination domain, I usually just guestimate it based on 10% of the outbound. Since enabling DNS RBL is going to surge your DNS queries, you can probably just look at the number of inbound messages and figure that this will equal the number of new DNS queries generated. It's more art than science here, so that is 'good enough' for me. Hope this helps, Ed Hi Mario,

There are a couple of ways you can determine how many SMTP connections your server is currently working with. The queue viewer is a graphical tool in the Exchange Management Console. Go to the toolbox, and you will see the queue viewer. Since you are probably more interested in the raw number of sessions (as opposed to the other side) you can also use Perfmon to view this. Look for the counters for “MSExchangeTransport SmtpReceive” and “MSExchangeTransport SmtpSend.”

If you want to see how many DNS queries your server is running at any point in time, you can only use Perfmon counters if the DNS server service is installed on the machine. You probably don’t have that service installed on your Exchange server, and your DNS server is probably already processing a ton of queries for other clients, so I would take a network trace on UDP 53 and just gather statistics that way. If your server processes both inbound and outbound mail, you will need to do some guesstimating to eliminate the DNS queries generated from sending mail, but I already mentioned that counter above. Just remember that your Exchange server’s resolver cache will hold on to records resolved for the duration of the TTL, so round down to nearest random number unless clear your resolver cache frequently during the monitoring, or reduce the maximum TTL for caching to 1.

· Start Registry Editor (Regedit.exe).
· Locate the MaxCacheEntryTtlLimit value under the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
· On the Edit menu, click Modify. Type 1, and then click OK.
· Quit Registry Editor.

I don’t recommend doing that, and since most systems I have dealt with send multiple emails to the same destination domain, I usually just guestimate it based on 10% of the outbound. Since enabling DNS RBL is going to surge your DNS queries, you can probably just look at the number of inbound messages and figure that this will equal the number of new DNS queries generated.
It’s more art than science here, so that is ‘good enough’ for me.

Hope this helps,
Ed

]]> By: Mario http://www.allspammedup.com/2008/12/using-ip-block-list-providers-and-the-connection-filter-agent-in-exchange-2007/comment-page-1/#comment-15596 Mario Tue, 26 Oct 2010 12:54:03 +0000 http://www.allspammedup.com/?p=240#comment-15596 Hello Paul, We're looking to implement spam blocking for quite a while now and have been looking into using Spamhause as RBL provider. What is unclear to me is how to check where we currently are with the number of SMTP connections and the DNSBL queries. Is there a way I can check this from our Exchange 2007 platform ? Thanks, Mario Hello Paul,

We’re looking to implement spam blocking for quite a while now and have been looking into using Spamhause as RBL provider.
What is unclear to me is how to check where we currently are with the number of SMTP connections and the DNSBL queries. Is there a way I can check this from our Exchange 2007 platform ?

Thanks,
Mario

]]>