Anti-spam implementations in a router at the network layer

• US 7,606,214 B1
• Filed: 09/14/2006
• Issued: 10/20/2009
• Est. Priority Date: 09/14/2006
• Status: Expired due to Fees

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Chandra Sekhar, Bharath Kumar, Liu, Shuosen Robert, Li, Jianda, Kodukula, Narasimham
• Primary Examiner(s): Sam; Phirin
• Application Number:
  US11/521,893
• Time in Patent Office: 1,132 Days
• Field of Search: None
• US Class Current: 370/351
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases

Abstract

In one embodiment, a router inspects at a network layer source addresses of network layer packets flowing through the router. The router compares the source addresses to addresses of computers employed by spammers, and performs a predetermined action on a particular network layer packet having a source address that belongs to a computer of a spammer. The predetermined action may involve dropping the particular network layer packet or limiting the data transfer rate of the particular network layer packet.

Claims

1. A method of performing anti-spam in a router in a computer network, the method comprising:

receiving in the router a TCP handshake packet from an initiating mail transfer agent, the TCP handshake packet being configured to initiate a connection with another mail transfer agent;

detecting receipt of the TCP handshake packet in the router;

determining an IP address of the initiating mail transfer agent;

consulting an externally located network reputation service to determine if the IP address belongs to a known spammer;

inspecting at a network layer a source IP address of an IP packet received in the router; and

performing a predetermined action on the IP packet in the router when the source IP address is that of the initiating mail transfer agent and the mail transfer agent is deemed by the network reputation service as belonging to a known spammer, wherein the predetermined action includes marking the IP packet as low priority as part of slowing down a data transfer rate of all packets from the initiating mail transfer agent.

2. The method of claim 1 wherein the predetermined action includes dropping the IP packet.

3. The method of claim 1 wherein marking the IP packet as low priority comprises modifying a value of a type of service field in a header of the IP packet.

4. The method of claim 1 further comprising:

propagating to other routers information that the initiating mail transfer agent sends spam when the mail transfer agent is deemed by the network reputation service as belonging to a known spammer.

5. The method of claim 1 wherein the router allows packets from the initiating mail transfer agent to go through while determining if the IP address belongs to a known spammer.

6. A method of performing anti-spam in a router in a computer network, the method comprising:

detecting reception of network layer packets in the router;

in the router, inspecting at a network layer source addresses of the network layer packets;

comparing in the router the source addresses to addresses of computers employed by spammers; and

in the router, performing a predetermined action on a particular network layer packet having a source address matching that of a computer employed by a spammer, wherein the predetermined action comprises marking the particular network layer packet as low priority to delay the routing of the particular network layer packet.

7. The method of claim 6 wherein detecting reception of the network layer packets in the router comprises:

detecting TCP handshake packets having a set SYN flag and a destination port number 25.

8. The method of claim 6 wherein the router allows network layer packets to flow through the router while the router verifies whether or not any of the network layer packets is from a computer employed by a spammer.

9. The method of claim 6 wherein the router consults an externally located network reputation service to determine whether a source address belongs to a computer employed by a spammer.

10. The method of claim 6 wherein the router does not allow network layer packets to flow through the router without first determining whether or not the network layer packets are from computers employed by spammers.

11. The method of claim 6 wherein the predetermined action comprises dropping the particular network layer packet.