Subject: sieve frequency based filtering

From: "Vihan Pandey" <[email-masked]>
Date: Thu, 5 Apr 2007 11:33:22 +0530

Hello,
        i'm new on this list, and i wanted to ask if frequency(with respect
to time slots) based filtering is possible in sieve.

e.g i'm getting 10 emails from [email-masked] in 1 minute - thus i want to
block any emails that are arriving greater than or equal to 10 in number in
1 minute.

Is it possible to do this in the current version of sieve? If yes how?

i've checked the draft on : http://www.ietf.org/rfc/rfc3028.txt?number=3028

and the new draft on :
http://www.ietf.org/internet-drafts/draft-ietf-sieve-3028bis-12.txt

But i couldn't figure out how i would do such a filtering.

Regards,

- vihan

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Thu, 5 Apr 2007 08:52:15 +0200

Vihan Pandey writes:
> e.g i'm getting 10 emails from [email-masked] in 1 minute - thus i want 
> to block any emails that are arriving greater than or equal to 10 in 
> number in 1 minute.

That'll be fun when your server comes up after some downtime and lots of 
queued mail is delivered in the first few minutes.

> Is it possible to do this in the current version of sieve? If yes how?

No.

Arnt

---

From: "Vihan Pandey" <[email-masked]>
Date: Thu, 5 Apr 2007 12:34:10 +0530

> queued mail is delivered in the first few minutes.

Good Point. However that aside if i have a situation of say 500,000 emails a
day from a single address that's something wherein that kind of a
functionality might prove useful. It's clearly suspicious behavior and ought
to be filtered.

> Is it possible to do this in the current version of sieve? If yes how?

Thanks for your prompt reply Arnt :-)

Regards,

- vihan