[sniffer] Re: Rule Panic on 3364665

2010-08-17 Thread Colbeck, Andrew
I have seen one hit, and it looks like a false positive to me. Sent as a sample to the false@ address. Thanks for the heads-up, Darin. Andrew. From: Message Sniffer Community [mailto:snif...@sortmonster.com] On Behalf Of Darin Cox Sent: Tuesday, August

[sniffer] Re: Rule Panic on 3364665

2010-08-17 Thread Pete McNeil
On 8/17/2010 3:10 PM, Darin Cox wrote: Hi, We've had a lot of FPs on this rule, and wanted to alert everyone on it. Pete, can you look into it? It's already dead. It was a binary rule for an image

[sniffer] Re: Rule Panic on 3364665

2010-08-17 Thread Darin Cox
We had 231 hits on that rule from 12:15pm to 3:03pm ET. At least 90% of them were FPs. Since there was a broad spectrum of customers and content affected, I'm guessing there was an error or over-generalization in the rule. Darin. - Original Message - From: Colbeck, Andrew To:

[sniffer] Re: Rule Panic on 3364665

2010-08-17 Thread Darin Cox
Thanks, Pete. Darin. - Original Message - From: Pete McNeil To: Message Sniffer Community Sent: Tuesday, August 17, 2010 3:37 PM Subject: [sniffer] Re: Rule Panic on 3364665 On 8/17/2010 3:10 PM, Darin Cox wrote: Hi, We've had a lot of FPs on this rule, and wanted to alert