Re: [sniffer] Spam storm?

Thu, 25 Mar 2004 23:57:17 -0800

snf2check does a byte length and partial checksum by default. The first and last few kbytes of the file are encrypted in sequence using Mangler. If any single bit of those two segments is missing or altered then the file will fail to authenticate. The only thing missing is a CRC for the middle parts of the file. In theory this is covered by TCP - but in practice not so much :-(

_M

At 12:48 AM 3/26/2004, you wrote:
How about a byte length compare or checksum of some sort?

Matt



Pete McNeil wrote:

At 06:25 PM 3/25/2004, you wrote:

We also saw many BAD_MATRIX errors last night.

If the problem was 'wget', shouldn't the snf2check
utility detect a corrupt file? Also, we did a manual
update yesterday afternoon and there were no 'wget'
error messages. The problem got corrected sometime
between last night and this morning.


Perhaps though some have had trouble throughout the day.

At the very least the verification on snf2check should
be improved to catch this issue. Updating with a bad
ruleset creates many problems.


Agreed. I'm looking for some simple ways to do that without changing the rulebase file format. There aren't any simple mechanisms that come to mind. Perhaps there will be no choice but to change the format in order to prevent this possibility.

_M


-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Pete McNeil
Sent: Thursday, March 25, 2004 7:06 PM
To: [EMAIL PROTECTED]
Subject: Re: [sniffer] Spam storm?

This helps narrow things down. Specifically we know that the rulebase files
are not corrupted on the server but during the download. That explains why
I haven't been able to recreate a problem in the lab.

I have a suspicion that wget may be failing intermittently.
Another customer recently had unexplainable, intermittent issues with wget.
They replaced wget with code of their own and have had no further problems.

Can we narrow this down to wget under heavy traffic conditions perhaps?

_M


This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html



This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html


--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================



This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html


This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html

Reply via email to