Well, usually. I've seen a surprising number of messages that have - for whatever reason - hit RAZOR2_CF_RANGE_11_50 or RAZOR2_CF_RANGE_51_100 but not RAZOR2_CHECK.
You know what, I think I figured out what's causing this. I've set a really low timeout for Razor in my SA config. The range tests will do a razor check if one hasn't already been made. So if the original razor check (for RAZOR2_CHECK) times out, then it'll try again for the other rules. If the second check succeeds, it triggers the second rule by itself.
So it's not a bug, it's just a consequence of the low timeout. And the end result (half the score) is better than it would be if the range tests only fired after a successful check (no score).
Kelson Vibber
SpeedGate Communications <www.speed.net>
-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Razor-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/razor-users
