http://scavenger.exa.org.uk, scavenger.exa.org.uk/ 2010-09-05T07:34:17+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/ http://scavenger.exa.org.uk, scavenger.exa.org.uk/lib/images/favicon.ico text/html 2009-01-24T22:13:17+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/95_percent_done?rev=1232835197&do=diff Almost done Array text/html 2009-01-28T13:27:03+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/bug_report?rev=1233149223&do=diff Reporting Bugs As soon as we get past finding hundreds a day, we will learn how to use JIRA. Feel free to get ahead of the game and start the ball rolling! text/html 2009-02-16T11:30:58+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/configuration?rev=1234783858&do=diff Configuring ScavengerEXA Quick Configuration You can quickly configure ScavengerEXA to evaluate it by following those instructions. Controlling ScavengerEXA How to get Scavenger to start at boot time or how to run each scavenger program from the command line (in order to test a configuration change for example). text/html 2009-02-08T09:05:21+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/craphound?rev=1234083921&do=diff Slashdot's response to this site will be .... In order to save time to our slashdot friends, here is the craphound filling for this software, just copy and paste to hopefully get a (Score:5, Funny) post ... Your post advocates a (X) technical ( ) legislative ( ) market-based ( ) vigilante approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to … text/html 2009-02-05T12:44:11+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/design?rev=1233837851&do=diff A Modular Approach In order to process a high volume of data, ScavengerEXA is built as a modular solution adaptable to many different network topologies. The complete solution comprises a number of discrete applications, from which users will be able to cherry pick components fulfilling their needs. text/html 2009-01-26T15:33:04+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/download?rev=1232983984&do=diff Downloading ScavengerEXA The ScavengerEXA Team has not yet released a stable version of the code. We expect to issue our first stable release toward the end of Q1 2009. Should you be interested in evaluating the application, feel free to get a copy of the source code via our svn tree. text/html 2009-01-23T00:18:28+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/faq?rev=1232669908&do=diff FAQ No, no one asked these question yet, but here are the answers anyway :-D Q: Why is it called ScavengerEXA ? A: As it is a carnivore A: which eats your network Junk A: And as it was developed by Exa Networks Limited Q: What are the dependencies for this program A: Python, tested with version 2.5.2 A: Twisted Matrix, event-driven networking engine A: the packet capture library (pcap) A: the dump packet module (dpkt) A: optional for policy, MySQL with the python M… text/html 2009-01-26T15:23:41+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/installation?rev=1232983421&do=diff Third Party Libraries Depending on the OS you wish to install ScavengerEXA under, you may need to install some third party libraries. Please visit the system requirements pages for more detailed information. Downloading ScavengerEXA To check on the latest release version, or for download and SVN locations, please visit the download page. text/html 2009-04-23T07:49:50+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/links?rev=1240469390&do=diff Related Links SpamHINTS, scavengerEXA inspiration Amazon EC3 spam issues University used to relay spam The BBC create a botnet using SPAM Spam harms the environment Botnet of 1.9 millions machine text/html 2009-02-16T08:22:43+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/linx64?rev=1234772563&do=diff An open source program to fight spam at the source Thomas Mangin Exa Networks Linx 64 2009/02/16 The spam battle Spammers: * BOTNETs, creating their own spam infrastructure * Lots of “low” volume source How respond: * Postmaster should get help some help from the 'network', spammers do. * The fight should be brought back to the edge text/html 2009-01-24T22:06:06+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/message_flow?rev=1232834766&do=diff Message Flow Here is how the information flows between the different applications constituing ScavengerEXA. This flow illustrates how the capture application can pass the information gathered to multiple dispatch backends, using source hashing on the address of the mail sender or round robin. text/html 2009-02-15T17:04:47+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/press?rev=1234717487&do=diff Press Please let us know if scavengerEXA appears in any press publication text/html 2009-01-29T15:31:04+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/quick_test?rev=1233243064&do=diff Evaluating ScavengerEXA Quick configuration If you do not feel like reading the documentation yet but want to see how scavengerEXA works, you can take it for a ride following those intructions: Scavenger default configuration is for a single machine installation. text/html 2009-02-16T11:32:32+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/running?rev=1234783952&do=diff Running the program In production You will need to have the daemontools program installed. The ScavengerEXA programs should be controlled by the supervise program. Supervise takes care of running the programs and restarting them should they fail, and connecting the printout of the application to the appropriate log file. text/html 2009-02-16T11:29:23+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/screenshot?rev=1234783763&do=diff Screenshot As everyone likes screenshots to have an idea of how an application works, here are some edited captures. Capture [root@sp-fw-1 scavenger]# ./service/scavenger-capture-pcap/run Psyco is not available ******************************************************************************** debug : 9 slow : False diffusion : rr promiscuous : False interface : eth0 internal : ['82.219.192.0/18', '82.219.9.0/24'] dispatc… text/html 2010-07-13T10:29:33+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/start?rev=1279013373&do=diff What is ScavengerEXA ScavengerEXA is an open source application stack, designed to reduce SPAM on the internet. ScavengerEXA differentiates itself from other solutions by analysing the mail leaving an ISP's network and not entering a mail server. ScavengerEXA can be run without a mail server, making it useful to a wider audience in the Internet infrastructure community (Hosting providers and Cloud services as well as ISP's, for example). text/html 2009-01-23T11:01:32+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/stop_spam_at_the_source?rev=1232708492&do=diff How is ScavengerEXA different ? ScavengerEXA does not participate in the mail conversation. You can use it without running a single mail server. ScavengerEXA simply observes mail conversations passing through a network to detect abnormal mail patterns and looking at the mail meta-data (sender, recipient, source and destination machines). At no point is the mail content itself analysed. text/html 2009-01-26T15:04:45+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/system_requirements?rev=1232982285&do=diff System Requirements Select which OS you would like to install ScavengerEXA on: Ubuntu 8.04 Fedora 10 text/html 2009-01-29T00:16:21+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/system_requirements_fedora?rev=1233188181&do=diff System Requirements for Fedora 10 (DRAFT DO NOT FOLLOW) Log with root privileges login: username password: password # su - root password: password Make sure your OS is up to date # yum update Install Dependencies twisted If you are going to run anything other than scavenger-capture, you need twisted. text/html 2009-01-29T15:56:15+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/system_requirements_ubuntu?rev=1233244575&do=diff System Requirements for Ubuntu 8.04 Ubuntu 8.04.2 server 386 Log with root privileges login: username password: password # sudo bash password: password Make sure your OS is up to date # apt-get update # apt-get upgrade Install Dependencies twisted If you are going to run anything other than scavenger-capture, you need twisted. text/html 2009-01-26T15:36:01+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/talks?rev=1232984161&do=diff Talks These are the places we have been invited to speak about ScavengerEXA: UKNOF 12 13rd of Febuary 2009 presentationLINX 64 16th of Febuary 2009 lightning talk We would be delighted should you want us to present this software to your community. text/html 2009-01-24T22:06:30+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/topology_inline?rev=1232834790&do=diff Topology Inline This diagram demonstrates how ScavengerEXA can be used inline (for small/medium networks) to automate the blocking of infected hosts. In this scenario, mail conversations (and mail conversations only) are policy routed to a linux server configured to act like a router. The Linux machine has two routes: text/html 2009-01-24T22:06:53+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/topology_mirror?rev=1232834813&do=diff Out of band topology In this scenario, a network administrator will use network equipment to mirror the traffic to a capture server, which will then send its captured message via the network to some possibly shared dispatch and policy servers. The DSL user will then be blocked using some other means like an email to the NOC to block the machine, or scavenger-action-radius which will change the customer profile and force a re-authentication. text/html 2009-02-05T12:45:33+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/topology_selective_mirror?rev=1233837933&do=diff Partial Out of band topology In this scenario, a network administrator will first separate mail flows from other traffic and then use network equipment to mirror the mail traffic only to a capture server, which will then send its captured message via the network to some possibly shared dispatch and policy servers. text/html 2009-02-11T18:06:35+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/uknof12?rev=1234375595&do=diff An open source program to fight spam at the source Thomas Mangin Exa Networks UKNOF 12 2009/02/13 The spam battle - Yesterday Mice: * Using existing mail servers, open relay * Few high volume source Cats: * scanning for open relay * Using RBL text/html 2009-01-24T21:45:27+01:00 http://scavenger.exa.org.uk, scavenger.exa.org.uk/scavenger/wiki?rev=1232833527&do=diff Editing this wiki In order to participate to this wiki, you will have to register. Anyone is currently allowed to edit documents. Should you want the ability to create new pages, please register an account and contact “scavenger at exa dot org dot uk” and we will add you to the contributor list.