Keith,
Have a look at this top bit from a spam's header: Received: from msins1.mseedi.com [210.94.172.180] by email.inhouseit.com with ESMTP (SMTPD32-7.13) id A238BC10058; Fri, 27 Sep 2002 05:42:32 -0700 Received: from mpovy.earthlink.net (65.100.240.33 [65.100.240.33]) by msins1.mseedi.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.1960.3) "Received" lines are added chronologically from the bottom up. In this example, the email was sent from a US West server (65.100.240.33) and bounced off an open relay server in Seoul Korea (210.94.172.180). With a HOPHIGH of 0, Declude's IP tests (including external black lists like SpamHaus) examine only the last/top IP in the chain. If the US West IP was blacklisted, it would not be seen. With a HOPHIGH of 1, Declude examines both IPs in the chain and either (OR, not AND) IP can trigger a test. This is a killer feature and not one I've seen on other systems. Dan On Friday, September 27, 2002 6:30, Keith Purtell <[EMAIL PROTECTED]> wrote: >I've been trying to understand this discussion about HOP/HOPHIGH. The docs describe >this as a >feature used when email is internally re-routed. Am I to assume >those who contributed to this thread >have that type of configuration? > >Keith Purtell, Web/Network Administrator >VantageMed Operations (Kansas City) >Email: [EMAIL PROTECTED] > > >CONFIDENTIALITY NOTICE: This email message, including any >attachments, is for the sole use of the >intended recipient(s) and may contain confidential and >privileged information. Any unauthorized >review, use, disclosure or distribution is prohibited. If you >are not the intended recipient, please >contact the sender by reply email and destroy all copies of the >original message. > > >-----Original Message----- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED]]On Behalf Of Dan Patnode >Sent: Thursday, September 26, 2002 3:03 PM >To: [EMAIL PROTECTED] >Subject: Re: [Declude.JunkMail] HOPHIGH > > >Bill, > >Mine is set to 2 (for a total of 3). I started at 0, then 1 >and found that spam still got around my >filters that would have been caught at 2. I changed it to 2 4+ >months ago and haven't looked back. >Your mileage may vary. I haven't seen a need to set it at 3. > >Dan > > > >On Thursday, September 26, 2002 11:19, Bill B <[EMAIL PROTECTED]> wrote: >>How affective is scanning at multiple Hops? I'm not setting >>HOPHIGH right now...but I'm currious if the people who are >>using it are seeing its benefits, or if it is causing them any >>problems. >> >>And what is the recommended HOPHIGH setting (assuming HOP is >>set to "0")? >> >>Bill >> >> > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
