Thanks Pete.
Hopefully these discussions (and seeing your responsiveness) will convince more folks decide to give Sniffer a try! >> I'm not completely sure what you are asking << The golden rule for external tests and for RBLs is - if you have multiple lines using the SAME "command" (e.g., the 18 "SNF" lines), or referring to the same external program (e.g., 5 invURIBL lines), or referring to the same blacklist (10 lines checking different return values), THEN only the FIRST line will actually "run" the test against that resource (e.g., run the external program, lookup the IP in the RBL). The OTHER lines will just evaluate the return code differently without rerunning the test. Now with the internal Sniffer implementation, we have three DIFFERENT commands (SNF, SNFIP, SNFIPREP). So it's worthwhile confirming whether the same golden rule applies here even though these are NOT multiple lines of the SAME command. From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Pete McNeil Sent: Wednesday, May 05, 2010 3:47 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Sniffer Integration -> Multiple Exit Codes On 5/5/2010 3:24 PM, Andy Schmidt wrote: Hi Dave (just in case this got overlooked - or I missed the answer), >> Also even though there are multiple entries the test only runs once and the resulted exit code is the triggered. << I know that all 18 "SNF" rule lines only require one invocation of Sniffer - which are then evaluated 18 different way. Fair enough. I also know that the 3 "SNFIP" rule lines are only one invocation - which is evaluated 3 different ways. And then there is the "SNFIPREP" rule. So I need to clarify this in my head. Will all 22 "SNF." rules (even though they are using 3 different commands) evaluate ONE invocation of Sniffer (just different return fields) or is EACH of these 3 command groups (SNF, SNFIP, SNFIPREPS) a separate entity that requires additional overhead? If I may -- I'm not completely sure what you are asking -- but if your concern is that the test for SNFIP and SNFIPREPS represent additional overhead then I can answer that. The amount of code that is run to execute these tests is vanishingly small. You should consider the overhead required to run all three tests as being no more than running the SNF pattern scan. The other two (SNFIP and SNFIPREPS) require so little work that their overhead is virtually impossible to measure. _M -- President MicroNeil Research Corporation www.microneil.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
