Hi Dave,
Thanks for taking the time to explain it. I see that the sample on your web
site has already been corrected to read "IPREPUTATION SNFIPREP " and I
was simply working off an earlier copy.
For the "SNF" test type, is there a way to have a "global" match (e.g.,
NONZERO), instead of having to specify each of the 18 (current) return codes
one at a time? The external Sniffer simply allow me to code:
SNIFFER external nonzero
"D:\IMAIL\Declude\SNF\SNFClient.exe" 10 0
Best Regards,
Andy
From: [email protected] [mailto:[email protected]] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 10:05 AM
To: [email protected]
Subject: RE: [Declude.JunkMail] Sniffer Integration
SNFIPBLACK SNFIP the 2nd variable value is 5 = Block and works as
an exit code.
IPREPUTATION works differently.
Note: IPREPUTATION SNFIP please update this to IPREPUTATION SNFIPREP
x 0 10 -5 this should be the default.
SNFIPREP represents a scale of -1----- 0 ----- 1 when the 2nd variable
(BASEPOINT) is set to 0 this will convert the IP reputation to this scale as
the examples below:
If final score is 0 no score is added to the email
dec0430.log 1842 04/30/2010 00:01:20.700 49319588 SNFIPRep the
Value of Result = 0.000000
If final score is + the 3rd variable score is used in this case 10
dec0430.log 7351 04/30/2010 00:07:14.043 49319625 SNFIPRep the
Value of Result = 0.267262
If final score is - the 4th variable score is used in this case -5
dec0430.log 11926 04/30/2010 00:08:50.340 49319647 SNFIPRep the
Value of Result = -0.267262
The BASEPOINT is the point value at which an email will be considered "Good"
if the result is to the left or "Bad" if to the right.
(SNIFFER RETURN) x 10 - (BASEPOINT) = Result
Example:
0.267262 x 10 - 0 = 2 This is positive then the test is triggered for 10
points.
0.267262 x 10 - 1 = 1 This is positive then the test is triggered for 10
points.
0.267262 x 10 - 2 = 0 Not Triggered.
0.267262 x 10 - 3 = -1 This is negative then the test is not-triggered for
-5 points.
0.267262 x 10 - 4 = -2 This is negative then the test is not-triggered for
-5 points.
-0.267262 x 10 - 0 = -2 This is negative then the test is not-triggered for
-5 points.
-0.267262 x 10 - 1 = -1 This is negative then the test is not-triggered for
-5 points.
-0.267262 x 10 - 2 = 0 Not Triggered.
-0.267262 x 10 - 3 = -1 This is negative then the test is not-triggered for
-5 points.
-0.267262 x 10 - 4 = -2 This is negative then the test is not-triggered for
-5 points.
David Barker
VP Operations Declude
Your Email security is our business
978.499.2933 office
978.988.1311 fax
<mailto:[email protected]> [email protected]
, April 30, 2010 1:26 AM
To: [email protected]
Subject: RE: [Declude.JunkMail] Sniffer Integration
Hi,
1. I'm confused about the Sniffer integration sample:
SNFIPBLACK SNFIP x 5 10 0
IPREPUTATION SNFIP x 5 10 -5
It seems to me as if BOTH lines test the SAME Sniffer return code of "5" -
but one line assigns adds a weight of 10 when found, the other also adds a
weight of 10, but subtracts 5 when NOT found?
So will this add "20" when found? Why use TWO lines to accomplish that?
2. In the past I could simply configure:
SNIFFER external nonzero
"D:\IMAIL\Declude\SNF\SNFClient.exe" 10 0
if I didn't want to duplicate 18 lines - and risk that at some point a
return code will be added that I will miss unless I add another line to the
config file.
So, does the "SNF" test have some way to configure ONE line for "nonzero" to
create a baseline weight, and then just add "SNF" tests for specific return
code if I want those specific ones treated with a higher weight?
Best Regards,
Andy
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [email protected], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
