I am using the built-in version of Sniffer and the recommended Declude setting.
However, lately I'm seeing lots of spam get through that is failing some of the
sniffer tests. I'd like to increase the weight on some of these failures.
Recommendations?
---
This E-mail came from the
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Sniffer settings
I am using the built-in version of Sniffer and the recommended Declude
setting.
However, lately I'm seeing lots of spam get through that is failing some of
the sniffer tests. I'd like to increase the weight on some
Just checking my sniffer logs. The following is an excerpt that I have a
question o0n:
s u='20101211142509' m='q559a524ab283.smd' s='0' r='0'
p s='12' t='15' l='2054' d='69'/
g o='0' i='216.16.233.12' t='u' c='0.968559' p='-0.73764'
r='Normal'/
On 12/13/2010 5:02 PM, Harry Vanderzand wrote:
Is
there any documentation on what I need to do.
Sure, right here:
http://www.armresearch.com/support/articles/software/snfServer/config/index.jsp
Dave,
Pete has helped me figure out that your XML samples, e.g.:
http://interim.declude.com/41048/Scanners/SNF/snf_engine.xml
is NOT a valid XML file.
Specifically, the closing tag for the node element is invalid.
It MUST be:
/node
(Currently it is
05, 2010 8:57 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] Sniffer Integration - Bad snf_engine.xml
Importance: High
Dave,
Pete has helped me figure out that your XML samples, e.g.:
http://interim.declude.com/41048/Scanners/SNF/snf_engine.xml
is NOT a valid XML
: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Monday, May 03, 2010 4:52 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP Reputation -- Graduated Weight
Scheme
Hi Dave,
I'm breaking this into two discussions as they are two
.
Best Regards,
Andy
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Wednesday, May 05, 2010 12:12 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP Reputation -- Graduated Weight
Scheme
Just a thought. We would have
On 5/5/2010 1:30 PM, Andy Schmidt wrote:
Hi Dave,
Hm
yes,I think if you
added 21 lines (from -10 to 0 and to +10) to the config file, you would
have could
cover the reputation range from -1 to +1 in 0.1 step increments.
Not
elegant but would
have the same effect as
...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works as an internal test and not as an external test. The main
difference being the location
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer IP Reputation -- Graduated Weight
Scheme
On 5/5/2010 1:30 PM, Andy Schmidt wrote:
Hi Dave,
Hm - yes,I think if you added 21 lines (from -10 to 0 and to +10) to the
config file, you would have could cover the reputation range from -1
Title: Release 4.10.42
On 5/5/2010 3:24 PM, Andy Schmidt wrote:
Hi
Dave
(just in case this got overlooked or I missed the
answer),
Also even though
there are multiple entries the test only runs once and the resulted
exit code
is the triggered.
I
know that all 18
these are NOT multiple lines of
the SAME command.
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Pete
McNeil
Sent: Wednesday, May 05, 2010 3:47 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer Integration - Multiple Exit Codes
On 5/5/2010 3:24 PM, Andy Schmidt
Title: Release 4.10.42
On 5/5/2010 4:05 PM, Andy Schmidt wrote:
snip/
The
golden rule for external tests and for RBLs is if
you have multiple lines using the SAME command
(e.g., the 18 SNF lines), or referring to the same external
program (e.g., 5 invURIBL lines), or
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works as an internal test and not as an external test. The main
difference being the location of the exit code. See external
: [Declude.JunkMail] Sniffer IP Reputation for white listing
Hi Pete,
Funny - our messages overlapped. But I'm glad I was on the right track with
my suspicions. Hopefully this will help Declude to refine things.
a better way to do it would be to scale the result so that from 0 to -1
the negative weight
: [Declude.JunkMail] Sniffer IP Reputation for white listing
As Pete already provided input on this. I am not going to prolix the answer
other than to say when implementing Message Sniffer we abided by the Pete's
advice Since many legitimate ISPs also produce a lot of spam it might be
useful to apply a bias
on with the use of this test.
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Monday, May 03, 2010 4:28 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer BasePoint
Hi Dave,
Let's keep the BasePoint a separate discussion
changes for BIG GBUdb values.
Best Regards,
Andy
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Monday, May 03, 2010 3:40 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP Reputation for white listing
As Pete already
, April 30, 2010 9:26 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP vs. Sniffer IP Reputation vs.
Sniffer Truncate
Thanks Pete - that confirms what I feared.
Declude's own sample should NOT be used as is because it duplicates the
IP
results (at minimum
On 4/30/2010 9:32 PM, Andy Schmidt wrote:
snip/
But your documentation of the reputation system has a graph that shows that
there is yet another category: WHITE.
I don't know the details of Declude's impelementation. Presumably they
could (or maybe even do) implement WHITE.
The
* 10 ) - 0 ) * -1 = -3
Reputation -1.0: ( ( 1.0 * 10 ) - 0 ) * -1 = -10
Best Regards,
Andy
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Saturday, May 01, 2010 10:11 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP vs
that is a
good enough compromise for day-to-day use.
Best Regards,
Andy
-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Pete
McNeil
Sent: Saturday, May 01, 2010 11:57 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail
On 5/1/2010 1:51 PM, Andy Schmidt wrote:
snip/
Right - that's the same scheme I just pointed
out to Dave
myself - except in my case you could pick a distinct factor for the
"-" vs. the "+" side of the scale (because Declude already
has that option anyhow)
I was
AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration
Hi,
1. I'm confused about the Sniffer integration sample:
SNFIPBLACK SNFIP x 5 10 0
IPREPUTATIONSNFIP x 5
[mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 10:05 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration
SNFIPBLACK SNFIP the 2nd variable value is 5 = Block and works as
an exit code.
IPREPUTATION works
: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Friday, April 30, 2010 10:31 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
Hi Dave,
Thanks for taking the time to explain it. I see
Peter decides to extend the list
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works
I have already added it to the dev list as an idea.
David
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Friday, April 30, 2010 11:52 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero
-Jim
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works as an internal test
\Declude\SNF\SNFClient.exe12 0
-Jim
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero
Hi Pete,
I'm look over Decludes recommended Sniffer configuration and trying to
understand how much overlap there is between these options:
IPREPUTATIONSNFIPREPx 0 10 -5
SNFIPCAUTIONSNFIP x 4 5 0
30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works as an internal test and not as an external test. The main
difference being the location of the exit code. See external is the 1st
variable whereas
On 4/30/2010 5:16 PM, Andy Schmidt wrote:
Hi Pete,
I'm look over Decludes recommended Sniffer configuration and trying to
understand how much overlap there is between these options:
IPREPUTATIONSNFIPREPx 0 10 -5
SNFIPCAUTIONSNFIP x
Sent: Friday, April 30, 2010 7:07 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer IP vs. Sniffer IP Reputation vs.
Sniffer Truncate
On 4/30/2010 5:16 PM, Andy Schmidt wrote:
Hi Pete,
I'm look over Decludes recommended Sniffer configuration and trying to
understand
: Friday, April 30, 2010 7:07 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer IP vs. Sniffer IP Reputation vs.
Sniffer Truncate
On 4/30/2010 5:16 PM, Andy Schmidt wrote:
Hi Pete,
I'm look over Decludes recommended Sniffer configuration and trying to
understand how much
Hi,
1. I'm confused about the Sniffer integration sample:
SNFIPBLACK SNFIP x 5 10 0
IPREPUTATIONSNFIP x 5 10 -5
It seems to me as if BOTH lines test the SAME Sniffer return code of 5 -
30, 2006 3:10 PMTo:
declude.junkmail@declude.comSubject: [Declude.JunkMail] Sniffer - New
Engine
Forthose using sniffer (like me) there is
a new engine that you can download.
It claims
to be twice as fast.
That should be very useful theses days where
spam traffice have increased a lot
Forthose using sniffer (like me) there is
a new engine that you can download.
It claims
to be twice as fast.
That should be very useful theses days where
spam traffice have increased a lot.
-Luis Arango
---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just
try here:
http://kb.armresearch.com/index.php?title=Message_Sniffer.GettingStarted.Distributions
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Craig EdmondsSent:
Monday, October 30, 2006 9:21 AMTo:
declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Sniffer
: RE: [Declude.JunkMail] Sniffer
- New EngineImportance: High
whats the link?
I cant find it here http://kb.armresearch.com/index.php?title=Main_Page
Kindest RegardsCraig
Edmonds123 Marbella InternetW: www.123marbella.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL
e.junkmail@declude.comSubject: [Declude.JunkMail] Sniffer vs. Commtouch
Hi All -
We've been very happy users of Sniffer for several years,
but now that Declude is including the Commtouch solution, we need t
Title: Message
I've been using commtouch for a few weeks now and
have noticed a significant reduction in spam.
This is in
addition to declude? Does a line get put in the config file to point to
this? Does this work with an older version of
Declude?
We have
.
Kindest RegardsCraig Edmonds123
Marbella InternetW: www.123marbella.comE : [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Sharyn SchmidtSent:
Wednesday, October 04, 2006 4:19 PMTo:
declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Sniffer
vs
] On Behalf Of Sharyn SchmidtSent:
Wednesday, October 04, 2006 8:19 AMTo:
declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Sniffer
vs. Commtouch
I've been using commtouch for a few weeks now and
have noticed a significant reduction in spam.
This is in
addition
Title: Message
Hi;
We are using Commtouch but it stopped working after
upgrading to the latest Declude release - .14.
I am not sure if others are having the problem .. but
for us Commtouch has not been working for over a week now.
Regards,
Kami
---This E-mail came from the
Hi All -
We've been very happy users of Sniffer for several years,
but now that Declude is including the Commtouch solution, we need to consider
it.
Any thoughts, comparisons, suggestions?
We're a very small shop, if that matters. We're not
an ISP, so the licensing weirdness doesn't
, October 03, 2006 11:56 AMTo:
declude.junkmail@declude.comSubject: [Declude.JunkMail] Sniffer vs.
Commtouch
Hi All -
We've been very happy users of Sniffer for several years,
but now that Declude is including the Commtouch solution, we need to consider
it.
Any thoughts, comparisons
Hi Sandy,
Sanford Whiteman wrote:
Well, we've lately been running Razor *and* Sniffer and have found no
reason to give up either one.
How do you have Razor configed? eg is it on a win32 box? If so would you
share how you did it?
-Nick
---
This E-mail came from the Declude.JunkMail mailing
How do you have Razor configed? eg is it on a win32 box? If so would
you share how you did it?
No, it's physically on a BSD box, called under Declude via the lovely
SPAMC32 (which, BTW, has a significant upgrade coming very soon).
--Sandy
Sanford
Is anyone running an alternative to Message Sniffer under Declude? Was
about to renew at the new price and was just wondering.
Thanks,
John C
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
Is anyone running an alternative to Message Sniffer under Declude?
Was about to renew at the new price and was just wondering.
Well, we've lately been running Razor *and* Sniffer and have found no
reason to give up either one. The combo is powerful, and I'd still say
Sniffer is worth the $,
Asked because I didn't know if there were any other alternatives. Sniffer has
performed well, but with the price jump, reduced educational discount (10 down
from 20%), and some really tight budgets, the smart thing to do is ask.
The Razor you mentioned, is that Vipul's Razor at Sourceforge?
The Razor you mentioned, is that Vipul's Razor at Sourceforge?
Yes.
--Sandy
Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]
SpamAssassin plugs into Declude!
I have mails backing up in my proc because Sniffer seems to be running
slow, or is this a Declude issue? I'm not really sure because Sniffer
seems to be processing the message very quickly, but Declude shows about
a 30 second lag time between calling Sniffer and getting any results
back ...
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Jay Sudowski -
Handy Networks LLC
Sent: Thursday, February 16, 2006 3:18 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Sniffer Slow / Declude Problem?
I have mails backing up in my proc
How do i get onto the sniffer email list?
-Anton
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives
Chris Anton wrote:
How do i get onto the sniffer email list?
-Anton
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
EXCELLLENT :-)
-Anton
-- Original Message --
From: Heimir Eidskrem [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date: Wed, 01 Feb 2006 15:18:11 -0600
Chris Anton wrote:
How do i get onto the sniffer email list?
-Anton
---
[This E-mail
Here is another method to install sniffer in persistent mode.
I just want to share it with you and others out there. I hope it is useful.
I am not sure if there is information about how to install persistent mode
using the windows resource kit tools in this list. So I decided to post it
just in
, January 18, 2006 1:15 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Sniffer in Persistent Mode using
Windows Resource Kit Tools
Here is another method to install sniffer in persistent mode.
I just want to share it with you and others out there. I hope
it is useful.
I am
shouldconnect to the service instead of executing the exe?
Markus -Original Message- From: [EMAIL PROTECTED] [mailto:
[EMAIL PROTECTED]] On Behalf Of Panda Consulting S.A. Luis Alberto Arango Sent: Wednesday, January 18, 2006 1:15 PM To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail
Services
519-741-1222
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Panda Consulting S.A. Luis Alberto Arango
Sent: Wednesday, January 18, 2006 7:15 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Sniffer in Persistent Mode
On Wednesday, January 18, 2006, 9:28:16 AM, Dean wrote:
DL Markus,
DL
DL You still point to the executable in your global config file,
DL but since sniffer is running in persistant mode, it doesn't
DL automatically launch a new instance.
That's almost correct... What happens is that the new
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Sniffer in Persistent Mode
using Windows
Resource Kit Tools
Here is another method to install sniffer in persistent mode.
I just want to share it with you and others out there. I hope it is
useful.
I am not sure
Hi,
Does anyone have a good list of all the
SNIFFER categories and different weights for them that they would like to
share?
Thanks
Goran Jovanovic
Omega Network
Solutions
:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic
Sent: Friday, January 13, 2006 10:23 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail]
Sniffer weighting
Hi,
Does anyone have a good list of all the
SNIFFER categories and different weights for them that they would like to
share
subject line at 80 and hold at
150
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)Sent: Friday, January 13, 2006 8:03 PMTo:
Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Sniffer
weighting
SNIFFER-TRAVEL
external 047 &q
, 2005 12:23
PM
Subject: [Declude.JunkMail] Sniffer
Invuribl
Hi all,
I have been using sniffer for a year and recently
add INVURIBL.
i am trying to find the corrolation between the 2
test to set the weight.
I tag at 10 and delete at 30..
I had sniffer at 14.
nowi added
Hi all,
I have been using sniffer for a year and recently
add INVURIBL.
i am trying to find the corrolation between the 2
test to set the weight.
I tag at 10 and delete at 30..
I had sniffer at 14.
nowi added invuribl with a max weight of
14.
i have spamcop at 9.
and a set of negative
Hi all,
I have been using sniffer for a year and recently
add INVURIBL.
i am trying to find the corrolation between the 2
test to set the weight.
I tag at 10 and delete at 30..
I had sniffer at 14.
nowi added invuribl with a max weight of
14.
i have spamcop at 9.
and a set of negative
On Sunday, October 2, 2005, 1:23:21 PM, Serge wrote:
S Hi all,
S
S I have been using sniffer for a year and recently add INVURIBL.
S i am trying to find the corrolation between the 2 test to set the weight.
S I tag at 10 and delete at 30..
S I had sniffer at 14.
S now i added invuribl with a
testing that combo test with the use of another external
filter for COUNTRY.
Erik
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
Sent: Sunday, October 02, 2005 12:19 PM
To: Serge
Cc: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Sniffer
I thought I used to have declude delete everything that sniffer found, now
when I went into my $default$.junkmail file I find its set to LOG.
I assume one of my network admins changed this at some time.
Am I relatively safe in setting it to delete or is this a bad idea?
__
It's best not to delete on one test. Although I weight sniffer very high on
my system.
Darrell
-
DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus. Try it
today - http://www.invariantsystems.com
Timothy Bohen writes:
I thought
Over the weekend, a lot of spam has been getting through. Checking the Declude
JunkMail log file shows the following:
09/10/2005 00:01:41.906 q84a2205001d48c60 ERROR: External program SNIFFER
didn't finish quick enough; terminating.
Can anyone shed some light on this? That is, what would
On Sunday, September 11, 2005, 11:46:12 PM, Kim wrote:
KP Over the weekend, a lot of spam has been getting through.
KP Checking the Declude JunkMail log file shows the following:
KP09/10/2005 00:01:41.906 q84a2205001d48c60 ERROR: External
KP program SNIFFER didn't finish quick enough;
I just setup Sniffer for the first time and I'm wondering what people
have their external test weight set to. My global.cfg came with a
sniffer test already configured (though it was commented out) to have a
weight of 7, which actually gives it a weight of 8 for some reason I
couldn't figure
] On Behalf Of Kevin Rogers
Sent: Friday, September 02, 2005 4:37 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Sniffer Question
I just setup Sniffer for the first time and I'm wondering what people
have their external test weight set to. My global.cfg came with a
sniffer test
Personally, my sniffer is set to 2/3 of my hold weight, that test really
doesn't give me troube as long as I keep my .snf file updated.
I'm curious as to what other people do as well.
- greg
I just setup Sniffer for the first time and I'm wondering what people
have their external test
John, does that mean sniffer runs 17 times on each mesage, or does it return
multiple codes?
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 02, 2005 8:02 PM
Subject: RE: [Declude.JunkMail] Sniffer Question
PROTECTED] On Behalf Of Dave Doherty
Sent: Friday, September 02, 2005 5:19 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer Question
John, does that mean sniffer runs 17 times on each mesage, or does it
return
multiple codes?
- Original Message -
From: John
-
DD From: John Tolmachoff (Lists) [EMAIL PROTECTED]
DD To: Declude.JunkMail@declude.com
DD Sent: Friday, September 02, 2005 8:02 PM
DD Subject: RE: [Declude.JunkMail] Sniffer Question
Best thing is to ask on the Sniffer List.
I actually have 17 Sniffer tests based upon exit code
Thanks.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 02, 2005 8:49 PM
Subject: RE: [Declude.JunkMail] Sniffer Question
In the Global.cfg, as long as the Sniffer call line is the same except
://www.invariantsystems.com
- Original Message -
From: Dave Doherty [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 02, 2005 8:19 PM
Subject: Re: [Declude.JunkMail] Sniffer Question
John, does that mean sniffer runs 17 times on each mesage, or does it
return
to 35. I hold at 25 and delete at 35.
John T
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On Behalf Of Kevin Rogers
Sent: Friday, September 02, 2005 4:37 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Sniffer
Overflow Queue Monitoring, SURBL/URI
integration, MRTG Integration, and Log Parsers.
- Original Message -
From: Kevin Rogers [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 02, 2005 9:41 PM
Subject: Re: [Declude.JunkMail] Sniffer Question
Thanks for all your
I was just playing with this today - I'm not sure I'd put much faith in
surbl.org. The first two messages I saw it tag in my own inbox, were very
legitimate. In fact, one of them was from Wells Fargo (*really*
from Wells Fargo, sent from Wells Fargo's own mail servers). I find this
ironic, since
est
RegardsAndy SchmidtPhone: +1 201 934-3414 x20
(Business)Fax: +1 201 934-9206
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of JonathanSent: Sunday, January 09, 2005 02:57
AMTo: Declude.JunkMail@declude.comSubject: Re:
[Dec
- Original Message -
From: Jonathan [EMAIL PROTECTED]
I was just playing with this today - I'm not sure I'd put much faith in
surbl.org. The first two messages I saw it tag in my own inbox, were
very legitimate. In fact, one of them was from Wells Fargo (*really*
from Wells Fargo,
Title: Message
Andy,
I'm not sure how you are seeing the results that you are seeing.
Sniffer tags from 95% to 97.5% of spam on any given day on my system
with a good portion of what gets through being either fresh spam
sources, niche spam or backscatter. Unless there was something wrong,
it
Sent: Sunday, January 09, 2005 2:56
AM
Subject: Re: [Declude.JunkMail] Sniffer
vs. SURBL
I was just playing with this today - I'm not sure I'd put much
faith in surbl.org. The first two messages I saw it tag in my own inbox, were
very legitimate. In fact, one of them was from Wells F
Title: Message
Sniffer that were tagged in this manner, and SURBL appears to be
much safer than invURIBL as a whole.
Matt, I am not sure what you mean by saying "SURBL
appears to be much safer than invURIBL".
invURIBL is a program that extracts domains out of
emails and allows you to look
Title: Message
My fault for mixing up names in this case. I was thinking about the
combined URIBL zone and not your version of the checker. The issue
that I was really intending to speak to was the combined zone
(multi.surbl.org) that some people are using over SURBL alone.
Matt
Darrell
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of MattSent: Sunday, January 09, 2005 10:23
AMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Sniffer vs. SURBLAndy,I'm not
sure how you are seeing the results that you are seeing. Sniffer tags
from 95% to 97.
- Original Message -
From: Matt [EMAIL PROTECTED]
My fault for mixing up names in this case. I was thinking about the
combined URIBL zone and not your version of the checker. The issue that
I was really intending to speak to was the combined zone
(multi.surbl.org) that some people
Let me re-summarize because I think that both you and Andy
misunderstood different elements of what I said.
First, Sniffer doesn't miss 11% of spam unless there was something
wrong. The stats provided were likely inaccurate for one reason or
another.
Second, Sniffer does cross checking with
PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of MattSent: Sunday, January 09, 2005 03:20
PMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Sniffer vs. SURBLLet me re-summarize
because I think that both you and Andy misunderstood different elements of
what I said.Firs
+1 201 934-9206
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Sunday, January 09, 2005 03:20 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer vs. SURBL
Let me re-summarize becau
: Sunday, January 09, 2005 5:16
PM
Subject: Re: [Declude.JunkMail] Sniffer
vs. SURBL
Andy,Again, Sniffer generally tags over 96% of
all spam on my system. That only leaves 4% that could possibly be tagged
by something else that Sniffer didn't hit. It is not likely that you are
seeing 11
1 - 100 of 146 matches
Mail list logo
