Michael, > I understand the suggested high value for windows XP, (since a > workstation isn't a mail server) > But the original suggested pattern matches, match this one as windows XP > (and score it high!) when it could just as well be a windows 2000 sp3 > server: > > X-Amavis-OS-Fingerprint: Windows XP SP1+, 2000 SP3, (distance 13, link: > header L_P0F_WXP X-Amavis-OS-Fingerprint =~ /^Windows XP/ > score L_P0F_WXP 3.5 > (3.5, way too high for Windows 2000 SP3) > p0f OS guess ham : spam > ----------------------------- > Windows-XP 0.7 % : 99.3 % > Windows-2000 5.8 % : 94.2 % > UNKNOWN 16.5 % : 83.5 % > Linux 58.8 % : 41.2 % > Unix 80.3 % : 19.7 % > (Unix+Linux 66.5 % : 33.5 %)
This should do: header L_P0F_WXP X-Amavis-OS-Fingerprint =~ /^Windows XP(?![^(]*\b2000 SP)/ Mark ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
