[sniffer] Sniffer, MDLP, and invURIBL?
I'm currently running Sniffer via Declude and use MDLP. Great! Since all the talk about invURIBL on the Imail list I thought I'd give it a try. The only problem I have is that it doesn't seem to be compatible with MDLP. invURIBL assigns its own weight to each message. The global.cfg line is as follows: INV-URIBL external weight "X:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP%" 0 0 I'm not an expert but the %WEIGHT% must pass the weight determined by invURIBL to Declude. I don't know what the variables of the weighting system are. I'm worried that I may start getting a bunch of false positives since MDLP can't manage the weighting of invURIBL. Would appreciate any advice from anyone that knows more about this than I do! Thanks, Joe
Re: [sniffer] Sniffer, MDLP, and invURIBL?
the %WEIGHT% passes the current message weight from Declude to INVURIBL. Used with SKIPWEIGHT option in invuribl.exe.config the %REMOTEIP% passes the sender's IP from Declude to INVURIBL. Used to whitelist IPs in senderipwhitelist.txt invuribl will find false positives, but is a very effective test. The INVURIBL weighting is determined with your setting in invuribl.exe.config I personally use multi.surbl.org and multi.uribl.com Name servers checked against sbl.spamhaus.org URI's "A" record checked agains sbl.spamhaus.org, cn-kr.blackholes.us and russia.blackholes.us - Original Message - From: Joe Wolf To: sniffer@SortMonster.com Sent: Saturday, February 25, 2006 11:05 AM Subject: [sniffer] Sniffer, MDLP, and invURIBL? I'm currently running Sniffer via Declude and use MDLP. Great! Since all the talk about invURIBL on the Imail list I thought I'd give it a try. The only problem I have is that it doesn't seem to be compatible with MDLP. invURIBL assigns its own weight to each message. The global.cfg line is as follows: INV-URIBL external weight "X:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP%" 0 0 I'm not an expert but the %WEIGHT% must pass the weight determined by invURIBL to Declude. I don't know what the variables of the weighting system are. I'm worried that I may start getting a bunch of false positives since MDLP can't manage the weighting of invURIBL. Would appreciate any advice from anyone that knows more about this than I do! Thanks, Joe
RE: [sniffer] Sniffer, MDLP, and invURIBL?
Joe, Are you using MDLP to autotune your weights in Declude? If so, you can exclude invURIBL and other tests which you don't want to change, whether because you think the weight is perfect, or because their randomness doesn't fit MDLP's idea of a weighting system. Check out this snippet from The McNeil on this list at some point in the past: "Use the #MDLP:MANUAL feature to lock these tests at the values you set. In your GLOBAL.CFG file create a line that lists the tests you want to adjust manually. #MDLP:MANUAL TEST1 TEST2 TEST3 You can also use more than one line if you wish... #MDLP:MANUAL TEST1 ... #MDLP:MANUAL TEST2 ... #MDLP:MANUAL TEST3 ... The #MDLP:MANUAL directive appears to be a comment to Declude so it will be otherwise ignored. If you have an #MDLP directive you want to comment out then you can add an additional # as in: ##MDLP:... This will cause MDLP to ignore it as well." Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe WolfSent: Saturday, February 25, 2006 9:05 AMTo: sniffer@SortMonster.comSubject: [sniffer] Sniffer, MDLP, and invURIBL? I'm currently running Sniffer via Declude and use MDLP. Great! Since all the talk about invURIBL on the Imail list I thought I'd give it a try. The only problem I have is that it doesn't seem to be compatible with MDLP. invURIBL assigns its own weight to each message. The global.cfg line is as follows: INV-URIBL external weight "X:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP%" 0 0 I'm not an expert but the %WEIGHT% must pass the weight determined by invURIBL to Declude. I don't know what the variables of the weighting system are. I'm worried that I may start getting a bunch of false positives since MDLP can't manage the weighting of invURIBL. Would appreciate any advice from anyone that knows more about this than I do! Thanks, Joe
Re: [sniffer] Sniffer, MDLP, and invURIBL?
I would actually prefer that MDLP autotune the weight for invURIBL, but since the weights are managed by invURIBL and not Declude I don't know how this will work. -Joe - Original Message - From: Colbeck, Andrew To: sniffer@SortMonster.com Sent: Saturday, February 25, 2006 12:35 PM Subject: RE: [sniffer] Sniffer, MDLP, and invURIBL? Joe, Are you using MDLP to autotune your weights in Declude? If so, you can exclude invURIBL and other tests which you don't want to change, whether because you think the weight is perfect, or because their randomness doesn't fit MDLP's idea of a weighting system. Check out this snippet from The McNeil on this list at some point in the past: "Use the #MDLP:MANUAL feature to lock these tests at the values you set. In your GLOBAL.CFG file create a line that lists the tests you want to adjust manually. #MDLP:MANUAL TEST1 TEST2 TEST3 You can also use more than one line if you wish... #MDLP:MANUAL TEST1 ... #MDLP:MANUAL TEST2 ... #MDLP:MANUAL TEST3 ... The #MDLP:MANUAL directive appears to be a comment to Declude so it will be otherwise ignored. If you have an #MDLP directive you want to comment out then you can add an additional # as in: ##MDLP:... This will cause MDLP to ignore it as well." Andrew 8) From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe WolfSent: Saturday, February 25, 2006 9:05 AMTo: sniffer@SortMonster.comSubject: [sniffer] Sniffer, MDLP, and invURIBL? I'm currently running Sniffer via Declude and use MDLP. Great! Since all the talk about invURIBL on the Imail list I thought I'd give it a try. The only problem I have is that it doesn't seem to be compatible with MDLP. invURIBL assigns its own weight to each message. The global.cfg line is as follows: INV-URIBL external weight "X:\INVURIBL\INVURIBL.exe %WEIGHT% %REMOTEIP%" 0 0 I'm not an expert but the %WEIGHT% must pass the weight determined by invURIBL to Declude. I don't know what the variables of the weighting system are. I'm worried that I may start getting a bunch of false positives since MDLP can't manage the weighting of invURIBL. Would appreciate any advice from anyone that knows more about this than I do! Thanks, Joe
Re[2]: [sniffer] Sniffer, MDLP, and invURIBL?
On Saturday, February 25, 2006, 1:38:53 PM, Joe wrote: JW JW JW I would actually prefer that MDLP autotune the weight for JW invURIBL, but since the weights are managed by invURIBL and not JW Declude I don't know how this will work. I'm not familiar enough with invURIBL to know how it is configured. However, as long as it's maximum and minumum weights are in a reasonable range, then if you exclude it from MDLP you should be ok. MDLP's AI tries to optimize the weights of the tests it can manipulate so that the most accurate total scores are provided. If there are tests it cannot adjust then it is forced to work around those with the other tests. The results are not predictable (the task is far too dynamic and contains far too many variables) but they should be sane and correct. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
