Re[4]: [Declude.JunkMail] SURBL vs. Sniffer?

2004-12-28 Thread Pete McNeil
On Tuesday, December 28, 2004, 11:06:59 AM, Andy wrote:

AS> Hi Pete,

AS> Is Sniffer performing URI checks as part of certain "return codes" only -

Sorry to respond twice but I want to clear up some potential confusion
- SNF includes URI as part of it's pattern matrix. It does not do any
specific URI checking. Rather, it simply recognizes known URI as
patterns of data in the message - there is no special mechanism for
it.

We code URI regularly as part of our rule generation process so URI
are commonly included in the pattern matrix. When scanning a message,
the entire pattern matrix is matched against the message at one time
so all recognized patterns are evaluated at once no matter what "kind"
of pattern they may be.

_M



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


Re[4]: [Declude.JunkMail] SURBL vs. Sniffer?

2004-12-28 Thread Pete McNeil
On Tuesday, December 28, 2004, 11:06:59 AM, Andy wrote:

AS> Hi Pete,

AS> Is Sniffer performing URI checks as part of certain "return codes" only -
AS> e.g., if I were to use SURBL to augment Sniffer, are there certain Sniffer
AS> Return Codes that are likely to overlap with SURBL lookups - or have all
AS> Sniffer return codes the potential of having been triggered by URI checks?

Experiemental Received IP (Result=63), Obfuscation Techniques
(Result=62), and Experimental Abstract (Result=61) are not likely to
include any URI data - Experimental Abstract may include generalized
versions of URI.

All of the other result codes are likely to overlap with URI data.

_M



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.