We just use a single test, we don't categorise. If SNIFFER returns a result we weight it. However, SNIFFER oftens returns a zero result when the email is obviously junk i.e. SNIFFER returns a positive result (spam) in about 30% of all identified junk mail.
SNIFFER external nonzero "\declude\sniffer\sniffer.exe" 23 0 -----Original Message----- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: 06 June 2006 11:17 To: Message Sniffer Community Subject: [sniffer]AW: [sniffer]AW: [sniffer]Concerned about amount of spam going through Hi There mus be something wrong with your configuration of the sniffer test(s) Here are my numbers from yesterday based on 24462 processed messages Date Test SS SH HH HS IMP 0605 SNIFFER-TRAVEL 12 0 0 23 2 0605 SNIFFER-INSUR 4 0 0 0 0 0605 SNIFFER-AV 0 0 0 0 0 0605 SNIFFER-MEDIA 1345 0 0 0 8 0605 SNIFFER-SWARE 73 0 0 0 0 0605 SNIFFER-SNAKE 8386 0 0 0 9 0605 SNIFFER-SCAMS 138 0 0 2 3 0605 SNIFFER-PORN 908 0 0 1 3 0605 SNIFFER-MALWARE 12 0 0 2 3 0605 SNIFFER-INK 2 0 0 0 0 0605 SNIFFER-RICH 2865 0 0 2 219 0605 SNIFFER-CREDIT 363 0 0 0 1 0605 SNIFFER-CASINO 300 0 0 0 0 0605 SNIFFER-GENERAL 2881 0 0 41 41 0605 SNIFFER-EXP-A 450 0 0 36 7 0605 SNIFFER-OBFUSC 4 0 0 5 0 0605 SNIFFER-EXP-IP 28 0 0 8 5 SS Sniffer says spam, final result too SH Sniffer says spam, final result not HH Sniffer says ham, final result too HS Sniffer says ham, final result not IMP Sniffer says spam and final result is slight above the hold weight. (This column is a part of the SS-column: 100-150% of hold) So a.) it's an important test because it's able to bring the spam above the hold weight and without this test it wasn't hold as spam. or b.) it's a risky test because it brings legit messages above the hold weight What result codes are you using in your test configuration? (please not publish your sniffer-id!) Markus > -----Ursprüngliche Nachricht----- > Von: Message Sniffer Community > [mailto:[EMAIL PROTECTED] Im Auftrag von David Waller > Gesendet: Dienstag, 6. Juni 2006 11:51 > An: Message Sniffer Community > Betreff: Re: [sniffer]AW: [sniffer]Concerned about amount of spam > going through > > Of all SPAM identified SNIFFER is finding about 30%. We see an awful > lot of junk email not being caught by SNIFFER, it's being processed by > Declude and failing some technical tests but not by SNIFFER. > > -----Original Message----- > From: Message Sniffer Community > [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: 06 June 2006 09:41 > To: Message Sniffer Community > Subject: [sniffer]AW: [sniffer]Concerned about amount of spam going > through > > > I only see Sniffer catching about 30% of SPAM and that's > the highest > > it's ever been. > > 30% of spam or 30% of all processed messages? > Sniffer is still one of the best tests in my arsenal. > > Markus > > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <sniffer@sortmonster.com>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to > the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch > to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > administrative queries to <[EMAIL PROTECTED]> > > > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <sniffer@sortmonster.com>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To > switch to the DIGEST mode, E-mail to > <[EMAIL PROTECTED]> To switch to the INDEX mode, > E-mail to <[EMAIL PROTECTED]> Send administrative > queries to <[EMAIL PROTECTED]> > > ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]> ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
