(Whups, I forgot the other important bit) Replying to my own email, here's the snf_engine.xml snippet
<header name='X-Telus-Outbound-IP:' received='.telus.net [' ordinal='0' /> Which is in the GBUDB/Training/Source section as per: http://www.armresearch.com/support/articles/software/snfServer/config/no de/gbudb/training/source-header.jsp Andrew. -----Original Message----- From: Message Sniffer Community [mailto:sniffer@sortmonster.com] On Behalf Of Colbeck, Andrew Sent: Monday, October 24, 2011 11:47 AM To: Message Sniffer Community Subject: [sniffer] Training GBUdb on the client IP for telus.net Given the attached header text, would this snippet in snf_engine.xml help me to train GBUdb on the email clients' IP address from this specific ISP? I tested by querying: SNFClient.exe -test 216.218.29.230 And then re-testing the spam, and then querying GBUdb again. The second test showed that "good count" had moved from zero to one and the whole email email scan status was "clean". That tells me the test is good, but I'm not sure it's "right". Thanks, Andrew. ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. This list is for discussing Message Sniffer, Anti-spam, Anti-Malware, and related email topics. For More information see http://www.armresearch.com To unsubscribe, E-mail to: <sniffer-...@sortmonster.com> To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com> To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com> Send administrative queries to <sniffer-requ...@sortmonster.com>
