Apparatuses and methods for identifying email and email servers

1. A non-transitory computer readable medium having program instructions stored thereon that are executable to cause a computer system to perform a method comprising:

examining a plurality of Internet Protocol (IP) packets from a plurality of source IP addresses to determine whether the IP packets include email content, wherein the examining includes, for each given IP packet in the plurality of IP packets:

searching the given IP packet for keywords indicative of email content;

maintaining a first count value based on a number of the keywords present in the given IP packet; and

based on the first count value reaching a first threshold value, determining that the given IP packet includes email content;

maintaining a plurality of second count value, each associated with a respective one of the plurality of source IP addresses, wherein each of the plurality of second count value specifies a number of packets from a source IP address that are determined to include email content based on the examining;

identifying a source IP address of the plurality of source IP addresses as being associated with a source of email traffic based on the second count value reaching a second threshold value; and

filtering traffic from the identified source IP address as email traffic.

2. The computer readable medium of claim 1 , wherein the filtering includes blocking traffic from the source IP address responsive to the identifying; and

wherein the program instructions are executable to examine IP packets directed to port numbers for non-email protocols.

3. The computer readable medium of claim 2 , wherein the IP packets include packets directed to a port for the Hypertext Transfer Protocol (HTTP).

4. The computer readable medium of claim 1 , wherein the keywords include one or more of the following: “subject,” “RE,” “FW,” “@,” “sender,” “hi,” “hello,” “attach,” “file,” “sender box,” “receiver,” and “receiver box.”

5. The computer readable medium of claim 1 , wherein the examining includes:

based on the first count value of the given IP packet reaching the first threshold value, analyzing the given packet for additional keywords indicative of email content; and

searching another IP packet for the additional keywords.

6. The computer readable medium of claim 1 , wherein the method further comprises:

prior to the examining, determining whether IP packets from the plurality of source IP addresses specify a source port for a Simple Mail Transfer Protocol (SMTP); and

wherein the examining is of IP packets determined to not specify the source port.

7. A method comprising:

a computer system receiving packets from a plurality of Internet Protocol (IP) addresses;

the computer system searching the received packets for keywords indicative of email content;

based on the searching, the computer system updating a first set of count values, wherein each count value in the first set identifies a number of keywords present in a respective one of the packets;

the computer system maintaining, based on the first set of count values, a second set of count values, wherein each count value in the second set identifies a number of packets determined to include email content received from a respective one of the plurality of IP addresses;

the computer system identifying ones of the plurality of IP addresses as being associated with email traffic based on count values in the second set reaching a threshold value, wherein the count values correspond to the IP addresses; and

the computer system blocking traffic from the identified IP addresses as email traffic.

8. The method of claim 7 , wherein the packets determined to include email content include packets directed to a Hypertext Transfer Protocol (HTTP) port.

9. The method of claim 7 , further comprising:

based on the first set of count values reaching a threshold value, the computer system examining one or more of the received packets to identify keywords indicative of email content; and

the computer system determining, based on the identified keywords, that a received one of the packets includes email content.

10. A method comprising:

a computer system determining whether packets from a plurality of Internet Protocol (IP) addresses include email content, wherein the determining includes, for each of the packets:

maintaining a first count value for the packet, wherein the first count value specifies a number of keywords present in the packet, wherein the keywords are indicative of email content; and

determining that the packet includes email content based on the first count value reaching a first threshold value;

the computer system maintaining a plurality of second count values, each associated with a respective one of the plurality of IP addresses, wherein each of the plurality of second count values specifies a number of packets from an IP address that are determined to include email content;

the computer system identifying IP addresses as being associated with email traffic based on ones of the plurality of second count values reaching a second threshold value; and

the computer system filtering traffic from the identified IP addresses as email traffic.

11. The method of claim 10 , further comprising:

based on the first count value reaching the first threshold value, analyzing a body of a packet to determine keywords associated with email content; and

updating a count value for another packet based on the other packet including one or more of the determined keywords.

12. The method of claim 10 , wherein the packets do not include packets from Transmission Control Protocol (TCP) port numbers 25, 110, or 143.

13. The method of claim 10 , wherein the filtering includes the computer system blocking traffic from the identified IP address.