Regarding the use of p0f, passive OS fingerprinting, as an anti-spam measure — on top of this analysis which I linked to a few weeks back, one of the emeritus SA guys, Craig Hughes, sends over some p0f experiences. Handily, this includes a more detailed breakdown by OS release:
I’ve been using the SA p0f plugin for nearly a month or so now both on gumstix’s web server and my hughes-family.org server, and it actually looks like it could be pretty useful. So far I’ve just been scoring 0.001 for each OS to collect data, but here’s the results amavis has logged:
This breakdown shows what %age of the stuff coming in via OS xyz is spam or ham. ie 84.6% of all mail received from Windows-2000 is spam, 14.9% is ham (the rest is viruses). The first numeric column is number of messages of each type. Statistics are only since the last time amavis restarted:
On his home machine (comcast cable modem connection) :
| spam.byOS.Windows-2000 | 438 | 1/h | 84.6 % |
| spam.byOS.Linux | 417 | 1/h | 18.3 % |
| spam.byOS.Windows-XP | 265 | 1/h | 97.8 % |
| spam.byOS.UNKNOWN | 135 | 0/h | 55.1 % |
| spam.byOS.Windows-XP/2000 | 24 | 0/h | 100.0 % |
| spam.byOS.Novell | 5 | 0/h | 100.0 % |
| spam.byOS.Windows-98 | 3 | 0/h | 60.0 % |
| spam.byOS.Windows-2003 | 2 | 0/h | 66.7 % |
| spam.byOS.FreeBSD | 2 | 0/h | 1.3 % |
| spam.byOS.Solaris | 1 | 0/h | 1.8 % |
| spam.byOS.Windows-SP3 | 1 | 0/h | 100.0 % |
| ham.byOS.Linux | 1851 | 6/h | 81.2 % |
| ham.byOS.FreeBSD | 143 | 0/h | 96.0 % |
| ham.byOS.UNKNOWN | 102 | 0/h | 41.6 % |
| ham.byOS.Windows-2000 | 77 | 0/h | 14.9 % |
| ham.byOS.Solaris | 56 | 0/h | 98.2 % |
| ham.byOS.NetCache | 6 | 0/h | 100.0 % |
| ham.byOS.Windows-XP | 6 | 0/h | 2.2 % |
| ham.byOS.Tru64 | 2 | 0/h | 100.0 % |
| ham.byOS.AIX | 2 | 0/h | 100.0 % |
| ham.byOS.Windows-98 | 2 | 0/h | 40.0 % |
| ham.byOS.Windows-2003 | 1 | 0/h | 33.3 % |
On gumstix.com (hosted at some provider in Texas):
| spam.byOS.Windows-2000 | 401 | 1/h | 58.4 % |
| spam.byOS.Windows-XP | 131 | 0/h | 92.9 % |
| spam.byOS.UNKNOWN | 64 | 0/h | 18.7 % |
| spam.byOS.Windows-XP/2000 | 29 | 0/h | 96.7 % |
| spam.byOS.FreeBSD | 11 | 0/h | 4.1 % |
| spam.byOS.Linux | 11 | 0/h | 0.5 % |
| spam.byOS.Windows-98 | 6 | 0/h | 85.7 % |
| spam.byOS.Solaris | 4 | 0/h | 3.3 % |
| spam.byOS.Windows-SP3 | 2 | 0/h | 100.0 % |
| ham.byOS.Linux | 1983 | 4/h | 97.6 % |
| ham.byOS.UNKNOWN | 277 | 0/h | 80.8 % |
| ham.byOS.Windows-2000 | 271 | 0/h | 39.4 % |
| ham.byOS.FreeBSD | 253 | 0/h | 93.7 % |
| ham.byOS.Solaris | 116 | 0/h | 96.7 % |
| ham.byOS.NetCache | 40 | 0/h | 100.0 % |
| ham.byOS.Windows-XP | 9 | 0/h | 6.4 % |
| ham.byOS.Windows-NT | 7 | 0/h | 70.0 % |
| ham.byOS.Novell | 3 | 0/h | 100.0 % |
| ham.byOS.Windows-XP/2000 | 1 | 0/h | 3.3 % |
| ham.byOS.Windows-98 | 1 | 0/h | 14.3 % |
| ham.byOS.Windows-2003 | 1 | 0/h | 100.0 % |
my home machine has a lot more relayed mail coming to it (all my various craig@* email addresses forward into there) which is probably why the linux spam rate is higher there — the relaying machines are probably running linux and forwarding spam through.
Interesting figures — but I’m still not-convinced that the correlation is quite high enough to form a good enough basis for solid anti-spam rules; reliable rules in the SpamAssassin core typically have over 95% accuracy at differentiating ham from spam (at least when we first check them in).
Update: it’s a natural for use as a Bayes token, though. The way amavisd-new implements p0f support is perfect for this use.
BTW, my guess is that many of the spam hits for “linux” are due to things like Netgear/Linksys routers, running embedded linuces. No evidence, just guessing ;)