Deep Six

Device Platform

At the heart of the DS-200 product is the hardware and firmware of the product itself. The DS-200 runs on a custom built embedded platform which does not utilize 3rd party applications for web, mail or console processing. All services were developed in house and tailored to the DS-200's specific needs.

This minimalist approach makes the DS-200 device an extremely efficient and hardened appliance suitable for deployment in any Internet environment.

The DS-200 embedded platform is highly optimized for performance and can deliver more message traffic per CPU clock cycle than any other product on the market. As a result, the DS-200 is able to offer a completely solid state low cost product with no moving parts, no noise, and no physical mechanisms to wear out such as hard drives or fans.

The DS-200 is truly a unique product that addresses the needs of a wide range of organizations.

Traffic Analysis Stage

The DS-200 Traffic Analysis stage performs analysis of inbound connections to assist in identifying sources of spam. >/

The Traffic Analysis stage uses data gathered from numerous DNSBL's and the connection itself. This data is processed using a filter matrix generated by the patent pending Deep Six filter generation platform. This platform produces a highly accurate classification of connecting servers.

The filter matrix utilized in the DS-200 is unique in that it doesn't use DNSBL's in the conventional manner. It doesn't simply use the existence of an address in a DNSBL as a decision basis, it leverages statistically determined relationships between groups of DNSBL states and augments that knowledge with characteristics derived from the connection itself.

This sophisticated approach enables the DS-200 to deliver much higher accuracy than any individual DNSBL.

Traffic Processing Stage

The DS-200 traffic processing stage accepts inbound mail connections destined for your domain and senses attributes about that connection. The Traffic analysis stage then produces a statistical analysis of the connecting server. The processing stage then makes a final decision to accept or reject delivery of mail traffic through the inbound connection. The Traffic Processing Stage does all this immediately upon connection and before any mail traffic is transferred over the Internet connection.

The DS-200 is one of the few products on the market which makes ALL of it's processing decisions before content is transmitted. Unlike solutions which accept content for analysis, not only is this much more efficient, this approach also has the benefit of letting spammers know that spamming attempts to these addresses are not successful. As a result, the addresses of customers operating DS-200 devices enjoy reduced spam delivery attempts the longer the device remains in operation as their addresses become deprioritized in the spammers' target queue.

If the Traffic Processing Stage determines that a sending server should be blocked, the connection is routed to an internal micro-SMTP server module which gracefully continues the SMTP session while rejecting any attempts to deliver mail. This performed entirely independently of the protected server. Spam delivery attempts are never seen by the protected server as the DS-200 conducts all necessary operations on it's own.

For connections which the Traffic Processing Stage determines are legitimate, the connection is tunneled seamlessly to the customer's protected mail server.

With the DS-200 Internet e-mail servers have no direct contact with your mail server. Only traffic from validated sources is safely routed to your mail server.

Filter Safeguards

In the unlikely event of a false positive decision made by the DS-200's Traffic Processing Stage, the DS-200 has several features which mitigate any lost or missing email traffic, making it one of the most robust solutions for protecting Internet e-mail correspondence.

First, if a mail transaction is rejected, the sender receives an immediate notification. This notification is delivered using the same messaging channel as other undeliverable notifications such as in the case of a mistyped email address. As the sender is the entity with the most knowledge about the nature of the communication, this is the ideal method of notification. Also, because this notification is handled through the same mechanism as undeliverable notification, it does not generate a new email message and is not vulnerable to forged sender addresses. This means that it does not generate any traffic to innocent parties such as occurs with systems that generate new email messages such as is seen with challenge response and "out of office" notifications. The DS-200 is completely Internet friendly and safe.

Second, the DS-200 permits customers to customize the undeliverable notification message. This allows customers to provide alternate contact means which improperly blocked senders can immediately use to deliver their message without any intervention by the recipient or any technical staff.

Lastly, the DS-200 also contains a built in module to greatly facilitate successful communication for situations where a legitimate sender is blocked, regardless of reason. The Web Gate module included with every DS-200 provides a web based form to allow senders to deliver a message to any user on the protected server and bypass the filtering stage. This page is hosted completely by the DS-200 itself and requires no external support or configuration. By activating the Web Gate module and including it's address in the customized rejection message, the DS-200 can offer guaranteed delivery of human generated email on a 24 by 7 basis with no recipient or technical stuff intervention.

It is also of interest to note, that the DS-200 employs this notification channel for EVERY rejected transaction. This ensures that no matter how remote the chance of a mistake, no legitimate message is ever rejected without active notification. When this channel is activated on a spam connection, spammers discard this notice as they focused on spam delivery, not RFC compliant behavior. For legitimate senders, this ensures that the party who best understands the urgency and nature of the communication, the sender, is immediately aware of the delivery failure and given the opportunity to convey their message by other available means.

Live Monitoring and Statistics

The DS-200 provides full live statistical information about the flow of traffic reaching the device. The DS-200 calculates numerous statistics about the filter performance, network performance, traffic volume, and DNSBL performance. All statistics are calculated in real time.

The DS-200 also provides a unique "Watch" mode that allows administrators to view device and mail activity in real time. This unique feature offers an unprecedented view into the real time activity of the mail traffic and filtering operations of a specific installation. This feature is very helpful in diagnosing problems, validating proper operations, and helping administrators get a real time "feel" for what is actually transpiring in their mail system.

The DS-200 "Watch" mode takes the mystery out of mail systems and filtering and helps administrators get a real time feel for the environment in which their server operates.

Activity Logging

The DS-200 provides full logging for all inbound connection to the device. The DS-200 offers local logging where log files are stored on locally on the device but also offers the ability to store log data remotely using the syslog protocol. With syslog logging, all DS200 log information may be captured by any specified computer running a syslog daemon or service.

Log information contains a timestamp, connecting server IP address, action taken (ALLOWED/REJECTED), and the decision basis for that action (session score, white list precedence, black list precedence.)

The DS-200 also offers the capability to remotely view locally stored log data via web browser using its internal micro http implementation.

Administration Facilities

The DS-200 provides a text based management console which may be accessed via the 9 pin RS-232 serial port on the device, or remotely via telnet.

The management console provides both a menu driven interface as well as command line instructions, offering ease of use for new administrators and expedient access for experienced users.

The DS-200 also provides an automatic online firmware update facility, permitting quick and hassle free updates.

That administrative interface permits configuration of network and mail servers, black/white list management, supplemental service configuration (Web Gate, Toolkit Sockets, Web log access, remote management, logging options, filter tuning, etc.) as well as full live statistics reports and real time address testing.

The DS-200 also supports a remote GUI administration application which provides routine administration functions, backup and restoration facilities, as well as e-mail server address lookup tools.

Toolkit Socket Support

The DS-200 also features a proprietary extension interface known as Toolkit Sockets. Toolkit Sockets allow for the use of device management functions by external extension applications. Currently Deep Six offers two tools which utilize the Toolkit Socket interface to facilitate device administration.

Outlook Plug-In: The DS-200 Outlook Plug-In facilitates the white/black listing of e-mail servers, and aids in the research of email origin servers (currently in beta release.)

Remote Management GUI: The DS-200 management GUI further extends use of the DS-200 by offering GUI based management of white and black lists, the backup of device configuration data/lists, and diagnostic tools such as real time scoring lookups.