Hello Pete,

Tuesday, February 7, 2006, 7:43:52 PM, you wrote:

PM> The rule would match the intended spam (and there was a lot of it, so
PM> 22,055 most likely includes mostly spam.

On spot check I'm seeing about 30-40% of the messages are valid.

PM> Unfortunately it would also match messages containing the listed
PM> capital letters in that order throughout the message. Essentially, if
PM> the text is long enough then it will probably match. A greater chance
PM> of FP match if the text of the message is in all caps. Also if there
PM> is a badly coded base64 segment and file attachment (badly coded
PM> base64 might not be decoded... raw base64 will contain many of these
PM> letters in mixed case and therefore increase the probability of
PM> matching them all).

Not sure, can anyone think of a way to cross check this? What if I put
all the released messages back through sniffer?

-- 
Best regards,
 David                            mailto:[EMAIL PROTECTED]



This E-Mail came from the Message Sniffer mailing list. For information and 
(un)subscription instructions go to 
http://www.sortmonster.com/MessageSniffer/Help/Help.html

Reply via email to