I suggest monitoring the sniffer hits and increase/decrease the scoring
accordingly depending on the false positives you see. Ideally you should
be combo'ing a sniffer hit w/other tests to maximize sniffers
effectiveness.
-Nick
MadRiverAccess.com|Skywaves.com Tech Support
US/Canada 877-873-6482
On 12/13/2010 5:02 PM, Harry Vanderzand wrote:
Is
there any documentation on what I need to do.
Sure, right here:
http://www.armresearch.com/support/articles/software/snfServer/config/index.jsp
Yes you are correct this was reported to us . The file should have been
updated with this release. I will ensure this is resolved. To correct this.
In the snf_engine.xml change node/ To /node
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Wednesday, May
: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Monday, May 03, 2010 4:52 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP Reputation -- Graduated Weight
Scheme
Hi Dave,
I'm breaking this into two discussions as they are two
.
Best Regards,
Andy
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Wednesday, May 05, 2010 12:12 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP Reputation -- Graduated Weight
Scheme
Just a thought. We would have
On 5/5/2010 1:30 PM, Andy Schmidt wrote:
Hi Dave,
Hm
yes,I think if you
added 21 lines (from -10 to 0 and to +10) to the config file, you would
have could
cover the reputation range from -1 to +1 in 0.1 step increments.
Not
elegant but would
have the same effect as
...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works as an internal test and not as an external test. The main
difference being the location
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer IP Reputation -- Graduated Weight
Scheme
On 5/5/2010 1:30 PM, Andy Schmidt wrote:
Hi Dave,
Hm - yes,I think if you added 21 lines (from -10 to 0 and to +10) to the
config file, you would have could cover the reputation range from -1
Title: Release 4.10.42
On 5/5/2010 3:24 PM, Andy Schmidt wrote:
Hi
Dave
(just in case this got overlooked or I missed the
answer),
Also even though
there are multiple entries the test only runs once and the resulted
exit code
is the triggered.
I
know that all 18
these are NOT multiple lines of
the SAME command.
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Pete
McNeil
Sent: Wednesday, May 05, 2010 3:47 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer Integration - Multiple Exit Codes
On 5/5/2010 3:24 PM, Andy Schmidt
Title: Release 4.10.42
On 5/5/2010 4:05 PM, Andy Schmidt wrote:
snip/
The
golden rule for external tests and for RBLs is if
you have multiple lines using the SAME command
(e.g., the 18 SNF lines), or referring to the same external
program (e.g., 5 invURIBL lines), or
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works as an internal test and not as an external test. The main
difference being the location of the exit code. See external
@declude.com
Subject: Re: [Declude.JunkMail] Sniffer IP Reputation for white listing
On 4/30/2010 9:32 PM, Andy Schmidt wrote:
snip/
But your documentation of the reputation system has a graph that shows
that
there is yet another category: WHITE.
I don't know the details
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP Reputation for white listing
Hi Pete,
Funny - our messages overlapped. But I'm glad I was on the right track with
my suspicions. Hopefully this will help Declude to refine things.
a better way to do it would be to scale
on with the use of this test.
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Monday, May 03, 2010 4:28 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer BasePoint
Hi Dave,
Let's keep the BasePoint a separate discussion
changes for BIG GBUdb values.
Best Regards,
Andy
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Monday, May 03, 2010 3:40 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP Reputation for white listing
As Pete already
, April 30, 2010 9:26 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP vs. Sniffer IP Reputation vs.
Sniffer Truncate
Thanks Pete - that confirms what I feared.
Declude's own sample should NOT be used as is because it duplicates the
IP
results (at minimum
On 4/30/2010 9:32 PM, Andy Schmidt wrote:
snip/
But your documentation of the reputation system has a graph that shows that
there is yet another category: WHITE.
I don't know the details of Declude's impelementation. Presumably they
could (or maybe even do) implement WHITE.
The
* 10 ) - 0 ) * -1 = -3
Reputation -1.0: ( ( 1.0 * 10 ) - 0 ) * -1 = -10
Best Regards,
Andy
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Saturday, May 01, 2010 10:11 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer IP vs
that is a
good enough compromise for day-to-day use.
Best Regards,
Andy
-Original Message-
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Pete
McNeil
Sent: Saturday, May 01, 2010 11:57 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail
On 5/1/2010 1:51 PM, Andy Schmidt wrote:
snip/
Right - that's the same scheme I just pointed
out to Dave
myself - except in my case you could pick a distinct factor for the
"-" vs. the "+" side of the scale (because Declude already
has that option anyhow)
I was
AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration
Hi,
1. I'm confused about the Sniffer integration sample:
SNFIPBLACK SNFIP x 5 10 0
IPREPUTATIONSNFIP x 5
[mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 10:05 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration
SNFIPBLACK SNFIP the 2nd variable value is 5 = Block and works as
an exit code.
IPREPUTATION works
: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Friday, April 30, 2010 10:31 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
Hi Dave,
Thanks for taking the time to explain it. I see
Peter decides to extend the list
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works
I have already added it to the dev list as an idea.
David
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Andy
Schmidt
Sent: Friday, April 30, 2010 11:52 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero
-Jim
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works as an internal test
\Declude\SNF\SNFClient.exe12 0
-Jim
From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David
Barker
Sent: Friday, April 30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero
Hi Pete,
I'm look over Decludes recommended Sniffer configuration and trying to
understand how much overlap there is between these options:
IPREPUTATIONSNFIPREPx 0 10 -5
SNFIPCAUTIONSNFIP x 4 5 0
30, 2010 11:14 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Sniffer Integration - Global Exit Code
nonzero?
The test works as an internal test and not as an external test. The main
difference being the location of the exit code. See external is the 1st
variable whereas
On 4/30/2010 5:16 PM, Andy Schmidt wrote:
Hi Pete,
I'm look over Decludes recommended Sniffer configuration and trying to
understand how much overlap there is between these options:
IPREPUTATIONSNFIPREPx 0 10 -5
SNFIPCAUTIONSNFIP x
Sent: Friday, April 30, 2010 7:07 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer IP vs. Sniffer IP Reputation vs.
Sniffer Truncate
On 4/30/2010 5:16 PM, Andy Schmidt wrote:
Hi Pete,
I'm look over Decludes recommended Sniffer configuration and trying to
understand
: Friday, April 30, 2010 7:07 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer IP vs. Sniffer IP Reputation vs.
Sniffer Truncate
On 4/30/2010 5:16 PM, Andy Schmidt wrote:
Hi Pete,
I'm look over Decludes recommended Sniffer configuration and trying to
understand how much
Hi,
1. I'm confused about the Sniffer integration sample:
SNFIPBLACK SNFIP x 5 10 0
IPREPUTATIONSNFIP x 5 10 -5
It seems to me as if BOTH lines test the SAME Sniffer return code of 5 -
whats the link?
I cant find it here http://kb.armresearch.com/index.php?title=Main_Page
Kindest RegardsCraig Edmonds123
Marbella InternetW: www.123marbella.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Panda Consulting S.A. Luis
Alberto ArangoSent: Monday, October
try here:
http://kb.armresearch.com/index.php?title=Message_Sniffer.GettingStarted.Distributions
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Craig EdmondsSent:
Monday, October 30, 2006 9:21 AMTo:
declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Sniffer
: RE: [Declude.JunkMail] Sniffer
- New EngineImportance: High
whats the link?
I cant find it here http://kb.armresearch.com/index.php?title=Main_Page
Kindest RegardsCraig
Edmonds123 Marbella InternetW: www.123marbella.com
From: [EMAIL PROTECTED]
[mailto:[EMAIL
I have been using CommTouch and Sniffer as my ONLY tests now for weighting purposes and I have yet to see a message that fails BOTH of them that is not SPAM.jeff
From: "Robert Grosshandler" [EMAIL PROTECTED]Sent: Tuesday, October 03, 2006 2:21 PMTo:
Title: Message
I've been using commtouch for a few weeks now and
have noticed a significant reduction in spam.
This is in
addition to declude? Does a line get put in the config file to point to
this? Does this work with an older version of
Declude?
We have
.
Kindest RegardsCraig Edmonds123
Marbella InternetW: www.123marbella.comE : [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Sharyn SchmidtSent:
Wednesday, October 04, 2006 4:19 PMTo:
declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Sniffer
vs
] On Behalf Of Sharyn SchmidtSent:
Wednesday, October 04, 2006 8:19 AMTo:
declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Sniffer
vs. Commtouch
I've been using commtouch for a few weeks now and
have noticed a significant reduction in spam.
This is in
addition
Title: Message
Hi;
We are using Commtouch but it stopped working after
upgrading to the latest Declude release - .14.
I am not sure if others are having the problem .. but
for us Commtouch has not been working for over a week now.
Regards,
Kami
---This E-mail came from the
I've been using commtouch for a few weeks now and have
noticed a significant reduction in spam. I never used sniffer so can't
compare. I have found a few false positives but only a
few.
Dan
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Robert
GrosshandlerSent: Tuesday,
Hi Sandy,
Sanford Whiteman wrote:
Well, we've lately been running Razor *and* Sniffer and have found no
reason to give up either one.
How do you have Razor configed? eg is it on a win32 box? If so would you
share how you did it?
-Nick
---
This E-mail came from the Declude.JunkMail mailing
Is anyone running an alternative to Message Sniffer under Declude?
Was about to renew at the new price and was just wondering.
Well, we've lately been running Razor *and* Sniffer and have found no
reason to give up either one. The combo is powerful, and I'd still say
Sniffer is worth the $,
Asked because I didn't know if there were any other alternatives. Sniffer has
performed well, but with the price jump, reduced educational discount (10 down
from 20%), and some really tight budgets, the smart thing to do is ask.
The Razor you mentioned, is that Vipul's Razor at Sourceforge?
I'll be damned. Apparently Diskeeper believes that Start Time really
means End Time and vice versa. Therefore, when I set a new defrag
schedule last night, it really decided to defrag between 7AM and 9PM,
not between 9PM and 7AM
It has been one of those weeks from hell over here.
-Jay
Chris Anton wrote:
How do i get onto the sniffer email list?
-Anton
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe
EXCELLLENT :-)
-Anton
-- Original Message --
From: Heimir Eidskrem [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date: Wed, 01 Feb 2006 15:18:11 -0600
Chris Anton wrote:
How do i get onto the sniffer email list?
-Anton
---
[This E-mail
So for no problem, but how we tell Declude or DecludeProc that he should
connect to the service instead of executing the exe?
Markus
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Panda Consulting S.A. Luis Alberto Arango
Sent: Wednesday,
Markus,
You still point to the executable in your global config file, but since sniffer is running in persistant mode, it doesn't automatically launch a new instance.
Dean
On 1/18/06, Markus Gufler [EMAIL PROTECTED] wrote:
So for no problem, but how we tell Declude or DecludeProc that he
I am confused with step 6
6. Next Add a Value and type this information Value Name:Application Data
Type: REG_SZ (String)
String: [full path of your sniffer installation]\snfrv2r3.exe
xnk05x5vmipeaof7 persistent
What is the Value name???
Thank you
Harry Vanderzand
inTown Internet Computer
The Value Name of Step 6 is:
Application
-Luis Arango
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Harry Vanderzand
Sent: Miércoles, 18 de Enero de 2006 01:13 p.m.
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail
SNIFFER-TRAVEL external
047 C:\Imail\Sniffer\yourlicensecode.exe yourverificationcode 15 0
SNIFFER-INSURANCE external
048 C:\Imail\Sniffer\yourlicensecode.exe yourverificationcode 15 0
SNIFFER-AV-PUSH external
049 C:\Imail\Sniffer\yourlicensecode.exe yourverificationcode 15 0
subject line at 80 and hold at
150
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John T
(Lists)Sent: Friday, January 13, 2006 8:03 PMTo:
Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Sniffer
weighting
SNIFFER-TRAVEL
external 047 &q
One potential area of concern is that Sniffer will
add rules for domains listed on surbl.
So a domain could potentiallyincorrectly get
listed in surbl and then in Sniffer. Causing both tests to false
positive.
So there is some overlap between the
tests.
That said,
I think surbl.org and
On Sunday, October 2, 2005, 1:23:21 PM, Serge wrote:
S Hi all,
S
S I have been using sniffer for a year and recently add INVURIBL.
S i am trying to find the corrolation between the 2 test to set the weight.
S I tag at 10 and delete at 30..
S I had sniffer at 14.
S now i added invuribl with a
testing that combo test with the use of another external
filter for COUNTRY.
Erik
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
Sent: Sunday, October 02, 2005 12:19 PM
To: Serge
Cc: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Sniffer
It's best not to delete on one test. Although I weight sniffer very high on
my system.
Darrell
-
DLAnalyzer - Comprehensive reporting on Declude Junkmail and Virus. Try it
today - http://www.invariantsystems.com
Timothy Bohen writes:
I thought
On Sunday, September 11, 2005, 11:46:12 PM, Kim wrote:
KP Over the weekend, a lot of spam has been getting through.
KP Checking the Declude JunkMail log file shows the following:
KP09/10/2005 00:01:41.906 q84a2205001d48c60 ERROR: External
KP program SNIFFER didn't finish quick enough;
Best thing is to ask on the Sniffer List.
I actually have 17 Sniffer tests based upon exit code, with weights ranging
from 15 to 35. I hold at 25 and delete at 35.
John T
eServices For You
-Original Message-
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
[EMAIL PROTECTED] On
Personally, my sniffer is set to 2/3 of my hold weight, that test really
doesn't give me troube as long as I keep my .snf file updated.
I'm curious as to what other people do as well.
- greg
I just setup Sniffer for the first time and I'm wondering what people
have their external test
John, does that mean sniffer runs 17 times on each mesage, or does it return
multiple codes?
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 02, 2005 8:02 PM
Subject: RE: [Declude.JunkMail] Sniffer Question
PROTECTED] On Behalf Of Dave Doherty
Sent: Friday, September 02, 2005 5:19 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer Question
John, does that mean sniffer runs 17 times on each mesage, or does it
return
multiple codes?
- Original Message -
From: John
Thanks.
- Original Message -
From: John Tolmachoff (Lists) [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 02, 2005 8:49 PM
Subject: RE: [Declude.JunkMail] Sniffer Question
In the Global.cfg, as long as the Sniffer call line is the same except
://www.invariantsystems.com
- Original Message -
From: Dave Doherty [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 02, 2005 8:19 PM
Subject: Re: [Declude.JunkMail] Sniffer Question
John, does that mean sniffer runs 17 times on each mesage, or does it
return
Thanks for all your help. I'll refer to the Sniffer list in the
future. But for the moment - I was wondering what the other Sniffer
tests would look like in your global.cfg file.
How do you test for certain return codes?
Also, what criteria are you using for these return codes (in other
Overflow Queue Monitoring, SURBL/URI
integration, MRTG Integration, and Log Parsers.
- Original Message -
From: Kevin Rogers [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Friday, September 02, 2005 9:41 PM
Subject: Re: [Declude.JunkMail] Sniffer Question
Thanks for all your
I was just playing with this today - I'm not sure I'd put much faith in
surbl.org. The first two messages I saw it tag in my own inbox, were very
legitimate. In fact, one of them was from Wells Fargo (*really*
from Wells Fargo, sent from Wells Fargo's own mail servers). I find this
ironic, since
est
RegardsAndy SchmidtPhone: +1 201 934-3414 x20
(Business)Fax: +1 201 934-9206
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of JonathanSent: Sunday, January 09, 2005 02:57
AMTo: Declude.JunkMail@declude.comSubject: Re:
[Dec
- Original Message -
From: Jonathan [EMAIL PROTECTED]
I was just playing with this today - I'm not sure I'd put much faith in
surbl.org. The first two messages I saw it tag in my own inbox, were
very legitimate. In fact, one of them was from Wells Fargo (*really*
from Wells Fargo,
Title: Message
Andy,
I'm not sure how you are seeing the results that you are seeing.
Sniffer tags from 95% to 97.5% of spam on any given day on my system
with a good portion of what gets through being either fresh spam
sources, niche spam or backscatter. Unless there was something wrong,
it
Sent: Sunday, January 09, 2005 2:56
AM
Subject: Re: [Declude.JunkMail] Sniffer
vs. SURBL
I was just playing with this today - I'm not sure I'd put much
faith in surbl.org. The first two messages I saw it tag in my own inbox, were
very legitimate. In fact, one of them was from Wells F
Title: Message
Sniffer that were tagged in this manner, and SURBL appears to be
much safer than invURIBL as a whole.
Matt, I am not sure what you mean by saying "SURBL
appears to be much safer than invURIBL".
invURIBL is a program that extracts domains out of
emails and allows you to look
Title: Message
My fault for mixing up names in this case. I was thinking about the
combined URIBL zone and not your version of the checker. The issue
that I was really intending to speak to was the combined zone
(multi.surbl.org) that some people are using over SURBL alone.
Matt
Darrell
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of MattSent: Sunday, January 09, 2005 10:23
AMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Sniffer vs. SURBLAndy,I'm not
sure how you are seeing the results that you are seeing. Sniffer tags
from 95% to 97.
- Original Message -
From: Matt [EMAIL PROTECTED]
My fault for mixing up names in this case. I was thinking about the
combined URIBL zone and not your version of the checker. The issue that
I was really intending to speak to was the combined zone
(multi.surbl.org) that some people
Let me re-summarize because I think that both you and Andy
misunderstood different elements of what I said.
First, Sniffer doesn't miss 11% of spam unless there was something
wrong. The stats provided were likely inaccurate for one reason or
another.
Second, Sniffer does cross checking with
PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of MattSent: Sunday, January 09, 2005 03:20
PMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Sniffer vs. SURBLLet me re-summarize
because I think that both you and Andy misunderstood different elements of
what I said.Firs
+1 201 934-9206
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Sunday, January 09, 2005 03:20 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Sniffer vs. SURBL
Let me re-summarize becau
: Sunday, January 09, 2005 5:16
PM
Subject: Re: [Declude.JunkMail] Sniffer
vs. SURBL
Andy,Again, Sniffer generally tags over 96% of
all spam on my system. That only leaves 4% that could possibly be tagged
by something else that Sniffer didn't hit. It is not likely that you are
seeing 11
:
Matt
To: Declude.JunkMail@declude.com
Sent: Sunday, January 09, 2005 9:23
AM
Subject: Re: [Declude.JunkMail] Sniffer
vs. SURBL
Andy,I'm not sure how you are seeing the results that
you are seeing. Sniffer tags from 95% to 97.5% of spam on any given day
on my system with a good
- Original Message -
From:
Matt
To:
Declude.JunkMail@declude.com
Sent:
Sunday, January 09, 2005 5:16 PM
Subject:
Re: [Declude.JunkMail] Sniffer vs. SURBL
Andy,
Again, Sniffer generally tags over 96% of all spam on my system. That
only
1 934-9206
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of MattSent: Sunday, January 09, 2005 05:17
PMTo: Declude.JunkMail@declude.comSubject: Re:
[Declude.JunkMail] Sniffer vs. SURBLAndy,Again,
Sniffer generally tags over 96% of all spam on
Title: Re: [sniffer] OT - exchange 5.5 help
Configure the IMS (internet mail service/connector in echange manager)
You have to disable the microsoft smtp server (iis5 smtp) exchange 55 has its own smtp
-Original Message-
From: [EMAIL PROTECTED] [EMAIL PROTECTED]
To:
Title: Message
Matt/Pete:
I may
not have understood your specific problem. But it's no clear in my mind,
what this would gain.
Here
is my sniffer configuration. It already allows me to score each result
code that it returns?
SNIFFER external nonzero "sniffer.exe licensecode" 6
0
In this case a message failing GREY or EXPERIMENTAL will
receive 10 + 15 = 25 points and all other result codes will receive 15
points
Remove the GREY and EXPERIMENTAL definitions, add all other
result codes with a weight of 5 and assign 10 points to the SNIFFER nonzero
line.
So GREY and
In other words is it possible to set an action of a test conditional
upon the total Declude value of the message.
I believe--but this may be outdated info--that you can pass the
%WEIGHT% var to a test (as well as some other in-progress parameters),
so you could set up an external test
Of Pete McNeil
Sent: Wednesday, December 03, 2003 8:10 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] sniffer
Brad,
That's right.
:-)
Heuristics for patterns are grouped by the spam that prompts us to generate
them, or by how we created them. Most of the time they are at least close
PROTECTED]
Sent: Thursday, December 04, 2003 4:02 PM
Subject: RE: [Declude.JunkMail] sniffer
Declude is optimized to run the external test only once
That was going to be my next question, it looked terribly in-efficient at
first!
Thanks for the responses guys. I just installed the demo.
~Brad
PROTECTED] On Behalf Of Mark Smith
Sent: Tuesday, December 02, 2003 7:54 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] sniffer
Sniffer's well worth the $300.00 per year.
That breaks down to less than $1.00 per day.
It catches content that some RBLs don't catch.
Mark
-Original
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] sniffer
It's not worth paying the subscription fee, in my opinion. I have a
client that's paying for it, and it doesn't catch very much that isn't
already caught somewhere else.
I am considering Maps too. But it's $1500/yr. Anyone using
0
You would need to adjust the weights to fit your own needs. However, this
will at least give you a starting point.
Bill
- Original Message -
From: T. Bradley Dean [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 6:43 PM
Subject: RE: [Declude.JunkMail] sniffer
. However, this
will at least give you a starting point.
Bill
- Original Message -
From: T. Bradley Dean [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Wednesday, December 03, 2003 6:43 PM
Subject: RE: [Declude.JunkMail] sniffer
How does Sniffer work?
Their web page says:
In the best
It's not worth paying the subscription fee, in my opinion. I have a client
that's paying for it, and it doesn't catch very much that isn't already
caught somewhere else.
I am considering Maps too. But it's $1500/yr. Anyone using them?
---
[This E-mail was scanned for viruses by Declude
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] sniffer
It's not worth paying the subscription fee, in my opinion. I
have a client that's paying for it, and it doesn't catch very
much that isn't already caught somewhere else.
I am considering Maps too. But it's $1500/yr. Anyone using
Hi,
I highly recommend it. I've been using it for over a year now and it has
caught a lot of spam.
I am considering Maps too. But it's $1500/yr. Anyone using them?
Kevin
At 01:36 PM 12/1/2003, you wrote:
Is sniffer worth the $300/year?
Thinking about trying it.
Thanks, andy
---
[This
Hi Andy,
I think Sniffer is available as a demo. It's worth trying.--
http://www.sortmonster.com/MessageSniffer/Try-It.html --
and I think it has improved in recent months.
fwiw: Sniffer catches a lot of stuff that is also caught by other (free)
ip4r and RHSBL lists. However, these last few
Absolutly worth it's cost...
Darrell
andyb writes:
Is sniffer worth the $300/year?
Thinking about trying it.
Thanks, andy
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe,
: [Declude.JunkMail] sniffer
Hi,
I highly recommend it. I've been using it for over a year now and it has
caught a lot of spam.
I am considering Maps too. But it's $1500/yr. Anyone using them?
Kevin
At 01:36 PM 12/1/2003, you wrote:
Is sniffer worth the $300/year?
Thinking about trying
1 - 100 of 117 matches
Mail list logo
