P0f is right, but regexp on sample rule causes false positive. Number is high enough that it almost always pushes total score > 5.
X-Amavis-OS-Fingerprint: Windows XP SP1+, 2000 SP3, (distance 11, link: System is confirmed to be a windows 2000 server, SP3. This rule is too broad: header L_P0F_WXP X-Amavis-OS-Fingerprint =~ /^Windows XP/ score L_P0F_WXP 1.1 Would this help? (yes, if you have NOT updated to SP4 you should suffer...) header L_P0F_W2kSP3 X-Amavis-OS-Fingerprint =~ /^Windows XP SP1\+, 2000 SP3/ score L_P0F_W2kSP3 -0.5 This would make score for the above match only .6 and not 1.1? ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
