  Despite a large amount of effort devoted in the past years trying to limit
unsolicited mail, spam is still a major global concern. Content-analysis
techniques and blacklists, the most popular methods used to identify and block
spam, are beginning to lose their edge in the battle. We argue here that one
not only needs to look into the network-related characteristics of spam
traffic, as has been recently suggested, but also to look deeper into the
network core, in order to counter the increasing sophistication of spam-ing
methods. Yet, at the same time, local knowledge available at a given server can
often be irreplaceable in identifying specific spammers. To this end, in this
paper we show how the local intelligence of mail servers can be gathered and
correlated pas- sively at the ISP-level providing valuable network-wide
information. Specifically, we use first a large network flow trace from a
medium size, national ISP, to demonstrate that the pre-filtering decisions of
individual mail servers can be tracked and combined at the flow level. Then, we
argue that such aggregated knowledge not only can allow ISPs to develop and
evaluate powerful new methods for fighting spam, but also to monitor remotely
what their own servers are doing.
