[sniffer] Re: Configuring Sniffer in declude....
Hello Keith, Yes (again presuming Declude is involved). Declude will call SNF only once and then will re-use the result to evaluate each version of SNF test you create IF each call to SNF is exactly the same... In this case that means, use weightgate on all of your SNF test lines or none of them or else SNF will be called more than once for each message. That statement is a bit simplified - but it's just about right. Hope this helps, _M Saturday, December 2, 2006, 8:55:07 PM, you wrote: > Pete, > Just wanted to make sure, however I do add weightgate to > each sniffer exit code I am checking? For example, 062, 063, etc. Thanks > again, > > Keith > > From: Message Sniffer Community on behalf of Pete McNeil > Sent: Fri 12/1/2006 11:37 AM > To: Message Sniffer Community > Subject: [sniffer] Re: Configuring Sniffer in declude > Hello Richard, > Friday, December 1, 2006, 10:08:39 AM, you wrote: >> Pete, >> Would it be beneficial to run WeightGate as service using one of >> the .exe to service techniques? > No. WeightGate is a simple switch designed to turn on (or off) another > program based on it's input parameters. > Specifically, for Declude, given the current weight for a message > WeightGate may NOT call an additional test. > The idea is that if the weight of the message is already high enough > to consider it spam then you can skip some additional tests. > WeightGate makes that relatively easy - that's it's only purpose. > Hope this helps, > _M > -- > Pete McNeil > Chief Scientist, > Arm Research Labs, LLC. > # > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: Configuring Sniffer in declude....
Pete, Just wanted to make sure, however I do add weightgate to each sniffer exit code I am checking? For example, 062, 063, etc. Thanks again, Keith From: Message Sniffer Community on behalf of Pete McNeil Sent: Fri 12/1/2006 11:37 AM To: Message Sniffer Community Subject: [sniffer] Re: Configuring Sniffer in declude Hello Richard, Friday, December 1, 2006, 10:08:39 AM, you wrote: > Pete, > Would it be beneficial to run WeightGate as service using one of > the .exe to service techniques? No. WeightGate is a simple switch designed to turn on (or off) another program based on it's input parameters. Specifically, for Declude, given the current weight for a message WeightGate may NOT call an additional test. The idea is that if the weight of the message is already high enough to consider it spam then you can skip some additional tests. WeightGate makes that relatively easy - that's it's only purpose. Hope this helps, _M -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]> <># This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: Configuring Sniffer in declude....
Hello Richard, Friday, December 1, 2006, 10:08:39 AM, you wrote: > Pete, > Would it be beneficial to run WeightGate as service using one of > the .exe to service techniques? No. WeightGate is a simple switch designed to turn on (or off) another program based on it's input parameters. Specifically, for Declude, given the current weight for a message WeightGate may NOT call an additional test. The idea is that if the weight of the message is already high enough to consider it spam then you can skip some additional tests. WeightGate makes that relatively easy - that's it's only purpose. Hope this helps, _M -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: Configuring Sniffer in declude....
Pete, Would it be beneficial to run WeightGate as service using one of the .exe to service techniques? Thanks, Pete McNeil wrote: Hello Keith, Thursday, November 30, 2006, 2:29:18 PM, you wrote: Pete, If you don't mind, does WeightGate add any noticeable CPU cycles to run on top of running Sniffer? Thanks for the aid. Using weightgate is bound to add some cycles -- loading a new program, but it is very lightweight and so I expect the cycles saved far outweigh those that are added. Hope this helps, _M -- Richard Lanard Information Technology Support University of Georgia Small Business Development Center # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: Configuring Sniffer in declude....
Hello Keith, Thursday, November 30, 2006, 2:29:18 PM, you wrote: > Pete, >If you don't mind, does WeightGate add any noticeable CPU cycles > to run on top of running Sniffer? Thanks for the aid. Using weightgate is bound to add some cycles -- loading a new program, but it is very lightweight and so I expect the cycles saved far outweigh those that are added. Hope this helps, _M -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: Configuring Sniffer in declude....
> If you don't mind, does WeightGate add any noticeable > CPU cycles to run on top of running Sniffer? Thanks for the aid. On a 100,000 emails per day on a 2.8 GHz Xeon, no, it doesn't. Andrew 8) > -Original Message- > From: Message Sniffer Community > [mailto:[EMAIL PROTECTED] On Behalf Of Keith Johnson > Sent: Thursday, November 30, 2006 11:29 AM > To: Message Sniffer Community > Subject: [sniffer] Re: Configuring Sniffer in declude > > Pete, >If you don't mind, does WeightGate add any noticeable > CPU cycles to run on top of running Sniffer? Thanks for the aid. > > Keith Johnson > > -Original Message- > From: Message Sniffer Community > [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil > Sent: Wednesday, November 29, 2006 4:57 PM > To: Message Sniffer Community > Subject: [sniffer] Re: Configuring Sniffer in declude > > Hello Chuck, > > If I might jump in here -- you are basically correct but > you'll have to rename ShowMe.exe to the original weightgate > name. When it is named ShowMe.exe it only records the command > line parameters in a log file as a debugging aid. > > Second, with that done this should work fine as long as each > command line is identical in Declude. > > Third, I noticed that your group IDs are out of date (based > on the names you've used) and most likely you will want to > revisit your weights also. > > A reference to the current group IDs (result codes) can be found here: > > http://kb.armresearch.com/index.php?title=Message_Sniffer.Tech > nicalDetai > ls.ResultCodes > > Hope this helps, > > _M > > Wednesday, November 29, 2006, 3:48:21 PM, you wrote: > > > Darrell: > > > If I want to use Weightgate I assume that I put it in for each > > instance of sniffer. Such as - > > > SNF external 063 "c:\tool\ShowMe.exe -50 %WEIGHT% 30 > > c:\SNF\sniffer.exe authenticationxx" 10 0 > > > > Chuck Schick > > Warp 8, Inc. > > (303)-421-5140 > > www.warp8.com > > > > > -----Original Message- > > From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On > > Behalf Of Darrell ([EMAIL PROTECTED]) > > Sent: Wednesday, November 29, 2006 12:33 PM > > To: Message Sniffer Community > > Subject: [sniffer] Re: Configuring Sniffer in declude > > > > Chuck, > > > Declude will only call Sniffer one time as long as the path and > > executable are identical which they are. > > > Darrell > > > > -- > > -- Check out http://www.invariantsystems.com for utilities > for Declude > > > And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI > > integration, MRTG > > > Integration, and Log Parsers. > > > - Original Message - > > From: "Chuck Schick" <[EMAIL PROTECTED]> > > To: "Message Sniffer Community" > > Sent: Wednesday, November 29, 2006 2:16 PM > > Subject: [sniffer] Configuring Sniffer in declude > > > > Several years ago when we first started using message > sniffer I set it > up > > for in the following manner in my global.cfg file. > > > > SNIFFER-GENERALexternal063 > > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 7 > > SNIFFER-EXPERIMENTALexternal062 > > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 12 > 0 > > SNIFFER-OBFUSCATIONexternal061 > > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode"11 > > > So one and so forth. > > > With the increase in spam and CPU load is there any advantage load > wise to > > just call sniffer once using nonzero instead of the return code. It > seems > > like someone told me that sniffer was only called once and not > seperately > > for each return code. > > > Could someone confirm that. > > > Chuck Schick > > Warp 8, Inc. > > (303)-421-5140 > > www.warp8.com > > > > > # > > This message is sent to you because you are subscribed to > > the mailing list . > > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To > switch to > > the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch > > to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send > > administrative queries to <[EMAIL PROTECTED]> > > > > > >
[sniffer] Re: Configuring Sniffer in declude....
Pete, If you don't mind, does WeightGate add any noticeable CPU cycles to run on top of running Sniffer? Thanks for the aid. Keith Johnson -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Wednesday, November 29, 2006 4:57 PM To: Message Sniffer Community Subject: [sniffer] Re: Configuring Sniffer in declude Hello Chuck, If I might jump in here -- you are basically correct but you'll have to rename ShowMe.exe to the original weightgate name. When it is named ShowMe.exe it only records the command line parameters in a log file as a debugging aid. Second, with that done this should work fine as long as each command line is identical in Declude. Third, I noticed that your group IDs are out of date (based on the names you've used) and most likely you will want to revisit your weights also. A reference to the current group IDs (result codes) can be found here: http://kb.armresearch.com/index.php?title=Message_Sniffer.TechnicalDetai ls.ResultCodes Hope this helps, _M Wednesday, November 29, 2006, 3:48:21 PM, you wrote: > Darrell: > If I want to use Weightgate I assume that I put it in for each > instance of sniffer. Such as - > SNF external 063 "c:\tool\ShowMe.exe -50 %WEIGHT% 30 > c:\SNF\sniffer.exe authenticationxx" 10 0 > Chuck Schick > Warp 8, Inc. > (303)-421-5140 > www.warp8.com > -Original Message- > From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On > Behalf Of Darrell ([EMAIL PROTECTED]) > Sent: Wednesday, November 29, 2006 12:33 PM > To: Message Sniffer Community > Subject: [sniffer] Re: Configuring Sniffer in declude > Chuck, > Declude will only call Sniffer one time as long as the path and > executable are identical which they are. > Darrell > -- > -- Check out http://www.invariantsystems.com for utilities for Declude > And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI > integration, MRTG > Integration, and Log Parsers. > - Original Message - > From: "Chuck Schick" <[EMAIL PROTECTED]> > To: "Message Sniffer Community" > Sent: Wednesday, November 29, 2006 2:16 PM > Subject: [sniffer] Configuring Sniffer in declude > Several years ago when we first started using message sniffer I set it up > for in the following manner in my global.cfg file. > SNIFFER-GENERALexternal063 > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 7 > SNIFFER-EXPERIMENTALexternal062 > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 12 0 > SNIFFER-OBFUSCATIONexternal061 > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode"11 > So one and so forth. > With the increase in spam and CPU load is there any advantage load wise to > just call sniffer once using nonzero instead of the return code. It seems > like someone told me that sniffer was only called once and not seperately > for each return code. > Could someone confirm that. > Chuck Schick > Warp 8, Inc. > (303)-421-5140 > www.warp8.com > # > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to > <[EMAIL PROTECTED]> To > switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > administrative queries to <[EMAIL PROTECTED]> > # > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to > <[EMAIL PROTECTED]> To > switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > administrative queries to <[EMAIL PROTECTED]> > # > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL
[sniffer] Re: Configuring Sniffer in declude....
Hello Chuck, If I might jump in here -- you are basically correct but you'll have to rename ShowMe.exe to the original weightgate name. When it is named ShowMe.exe it only records the command line parameters in a log file as a debugging aid. Second, with that done this should work fine as long as each command line is identical in Declude. Third, I noticed that your group IDs are out of date (based on the names you've used) and most likely you will want to revisit your weights also. A reference to the current group IDs (result codes) can be found here: http://kb.armresearch.com/index.php?title=Message_Sniffer.TechnicalDetails.ResultCodes Hope this helps, _M Wednesday, November 29, 2006, 3:48:21 PM, you wrote: > Darrell: > If I want to use Weightgate I assume that I put it in for each instance of > sniffer. Such as - > SNF external 063 "c:\tool\ShowMe.exe -50 %WEIGHT% 30 c:\SNF\sniffer.exe > authenticationxx" 10 0 > Chuck Schick > Warp 8, Inc. > (303)-421-5140 > www.warp8.com > -Original Message- > From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf > Of Darrell ([EMAIL PROTECTED]) > Sent: Wednesday, November 29, 2006 12:33 PM > To: Message Sniffer Community > Subject: [sniffer] Re: Configuring Sniffer in declude > Chuck, > Declude will only call Sniffer one time as long as the path and executable > are identical which they are. > Darrell > > Check out http://www.invariantsystems.com for utilities for Declude And > Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG > Integration, and Log Parsers. > - Original Message - > From: "Chuck Schick" <[EMAIL PROTECTED]> > To: "Message Sniffer Community" > Sent: Wednesday, November 29, 2006 2:16 PM > Subject: [sniffer] Configuring Sniffer in declude > Several years ago when we first started using message sniffer I set it up > for in the following manner in my global.cfg file. > SNIFFER-GENERALexternal063 > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 7 > SNIFFER-EXPERIMENTALexternal062 > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 120 > SNIFFER-OBFUSCATIONexternal061 > "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode"11 > So one and so forth. > With the increase in spam and CPU load is there any advantage load wise to > just call sniffer once using nonzero instead of the return code. It seems > like someone told me that sniffer was only called once and not seperately > for each return code. > Could someone confirm that. > Chuck Schick > Warp 8, Inc. > (303)-421-5140 > www.warp8.com > # > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to > <[EMAIL PROTECTED]> To > switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > administrative queries to <[EMAIL PROTECTED]> > # > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to > <[EMAIL PROTECTED]> To > switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > administrative queries to <[EMAIL PROTECTED]> > # > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: Configuring Sniffer in declude....
Darrell: If I want to use Weightgate I assume that I put it in for each instance of sniffer. Such as - SNF external 063 "c:\tool\ShowMe.exe -50 %WEIGHT% 30 c:\SNF\sniffer.exe authenticationxx" 10 0 Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com -Original Message- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Wednesday, November 29, 2006 12:33 PM To: Message Sniffer Community Subject: [sniffer] Re: Configuring Sniffer in declude Chuck, Declude will only call Sniffer one time as long as the path and executable are identical which they are. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: "Chuck Schick" <[EMAIL PROTECTED]> To: "Message Sniffer Community" Sent: Wednesday, November 29, 2006 2:16 PM Subject: [sniffer] Configuring Sniffer in declude Several years ago when we first started using message sniffer I set it up for in the following manner in my global.cfg file. SNIFFER-GENERALexternal063 "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 70 SNIFFER-EXPERIMENTALexternal062 "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 120 SNIFFER-OBFUSCATIONexternal061 "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode"110 So one and so forth. With the increase in spam and CPU load is there any advantage load wise to just call sniffer once using nonzero instead of the return code. It seems like someone told me that sniffer was only called once and not seperately for each return code. Could someone confirm that. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]> # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]> # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
[sniffer] Re: Configuring Sniffer in declude....
Chuck, Declude will only call Sniffer one time as long as the path and executable are identical which they are. Darrell Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. - Original Message - From: "Chuck Schick" <[EMAIL PROTECTED]> To: "Message Sniffer Community" Sent: Wednesday, November 29, 2006 2:16 PM Subject: [sniffer] Configuring Sniffer in declude Several years ago when we first started using message sniffer I set it up for in the following manner in my global.cfg file. SNIFFER-GENERALexternal063 "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 70 SNIFFER-EXPERIMENTALexternal062 "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode" 120 SNIFFER-OBFUSCATIONexternal061 "F:\IMail\Declude\sniffer2r32\licensecode.exe activationcode"110 So one and so forth. With the increase in spam and CPU load is there any advantage load wise to just call sniffer once using nonzero instead of the return code. It seems like someone told me that sniffer was only called once and not seperately for each return code. Could someone confirm that. Chuck Schick Warp 8, Inc. (303)-421-5140 www.warp8.com # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]> # This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
