On Monday, June 14, 2004, 1:56:00 AM, Matt wrote: M> Pete,
M> Experimental.� If these rules were in a differentcategory, it would M> make me feel a lot better about it.� I'm guessingmaybe from my M> standpoint, Spamware would be the most appropriatecategory for M> tagging forged message ID's of this type.� This is such alarge M> issue presently that it does matter somewhat and I would feelmuch M> more comfortable not having to use combo filters with M> theExperimental result code. I will move the new rule to the malware group since it detects messages transmitted from a particular worm. The spamware group currently contains rules for messages advertising spam services and resources so putting the forged header rule in that group would be a significant departure from it's current character. M> BTW, here's an example of a bounce that I blocked after M> includingExperimental in our BOUNCER combo filter.� I honestly M> can't tell ifthis is legitimate or not, and I can't see any signs M> of spam contentwhich makes me think it was the IP that triggered It was an IP rule. I've treated this as a false positive indication and dropped the rule. If you have other false positives then please submit them through the false positive process so that we can process them. This particular rule has been in place since 20040205 with no prior false positive reports and a rule strength of 1.88+. The rule was sourced through our spamtraps indicating strongly that there was some kind of spam or malware delivered through that IP back in February. M> the hit, but I'mposting it here so that you might be able to tell M> me what rule hit.�The log entry is above the source.� I'm just M> trying to figure out howto tune my system appropriately and M> wondering if I need to be on thelookout for legitimate servers M> tagged by Experimental which due totheir inclusion now in combo M> filters, may cause legitimate E-mail tobounce. If this is a significant problem for you then we can remap some rules to different categories for you. This is expensive for us and makes it difficult to administer and debug your rulebase (since it will be unique) but it can be done if necessary. Best, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
