The volume of unsol icited commercial e-mai ls, also known as spam, is in such a rapidrnincrease that almost over 90% of all e-mail messages are spam. We are in a state wherernan average of200 bill ion e-mail spamsare sent eachday. This problem is exacerbated byrnthe fact that many of these spams contain some sort of malicious code for attack. Inrnaddition to wasting of users' time and attack threats, the huge amount of spam alsornconsumes bandwidth and storage spaces illegally. There have been efforts over the yearsrnto combat spam messages. The most popular ones arc based on e-mail content analysisrnand IP address reputation. Techniques based on e-mail content analysis arc fall ing behindrnbecause of spammers' ability to trick such filters using legitimate e-mail-like words inrntheir contents. The introduction of image and PDF spams is also another headache forrncontent based filters. Fi lters based on IP add ress reputat ion are also not coping well withrnthe spammers because of the dynamic nature of II) addresses and the difficulty of huntingrndown malicious addresses before significant damages are donc. Our approach is to filterrnout spam messages before they are delivered to the user's inbox based on packet flowrncharacteristi cs. This is a complimentary approach that can be used with other techniquesrnto reduce the number of spam messages reaching users' inbox. Our approach is based onrnover 55,000 packet flow records. We have identified nine features that best different iaternspam from legitimate e-mail. Based on these attributes and a classification model with anrnaccuracy of 99.5% and a fal se-positive of 2.6%, we have developed a ranking algorithmrnthat scores a given flow into one of five categories. Based on these scores, a given packetrnflow will be accepted, rejected or will be passed for further examination by otherrntech niques. In addition to giving the advantage of not rel ying on e-mail content or IPrnaddress to filter spam, our method also avoids the wastage of resources like bandwidthrnand storage space by spam messages.