How long DHAP blocking connection

[agus.pracoyo]

Hi,

I want to configure DHAP, but don't know how long Ironport block sender IP if DHAP threshold is reached. Is it permanent ? or temporary? if temporary can we set the time ?

Regards

Agus Pracoyo

[Mathew Huynh · Accepted solution]

Hello Agus,

It will be a temporary block.

I believe it's fixed to a 1 hour block once threshold met.

You can use the command in the CLI > grep “Warning: Dropping connection due to potential Directory Harvest Attack from host=” mail_logs

and it will bring up every instance where the directory harvest was being undertaken.

I hope this helps.

Matthew

[agus.pracoyo]

Thanks a lot Matthew

[Mathew Huynh]

Happy to help.
Let us know if there is any other questions or issues with DHAP when you go about to using it.

[Bob Fayne]

No email for you, 1 hour!

You can change that time on a global basis with the Injection Counters Reset Period. From the GUI you can get to the setting under Network and from the CLI it's under listenerconfig/setup.

Network->Listeners->Edit Global Settings

Bear in mind that because this is a global setting it also changes the HAT rate limiting from messages per hour to messages per xxx time. You can set anything from 1 minute to 4 hours.

The main purpose according to docs is to allow high-volume receivers to shorten the time to avoid performance issues. This infers that too high of a setting can(will) introduce performance issues, particularly with memory so I don't recommend setting it much higher than an hour.