David, Are you using the free version of sniffer? Or did you deliberately change your .exe name in your posting to sniffer.exe to hide your licence number?
I certainly expect that the rulebase lag with the free version will result in lower Message Sniffer hit rates. I've seen the free version with hit rates as low as 10% on the remaining messages that have been already filtered by a gateway, which I thought was still decent because these were the messages that had already evaded the blacklist tests. And free is good. On the same system, I noted that this made Sniffer about half as effective as fresh SURBL/URIBL testing, but I had no way to compare their overlap. Andrew 8) > -----Original Message----- > From: Message Sniffer Community > [mailto:[EMAIL PROTECTED] On Behalf Of David Waller > Sent: Tuesday, June 06, 2006 5:46 AM > To: Message Sniffer Community > Subject: Re: [sniffer]AW: [sniffer]AW: [sniffer]Concerned > about amount of spam going through > > We just use a single test, we don't categorise. If SNIFFER > returns a result we weight it. However, SNIFFER oftens > returns a zero result when the email is obviously junk i.e. > SNIFFER returns a positive result (spam) in about 30% of all > identified junk mail. > > SNIFFER external nonzero "\declude\sniffer\sniffer.exe" 23 0 > > > -----Original Message----- > From: Message Sniffer Community > [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: 06 June 2006 11:17 > To: Message Sniffer Community > Subject: [sniffer]AW: [sniffer]AW: [sniffer]Concerned about > amount of spam going through > > Hi > > There mus be something wrong with your configuration of the > sniffer test(s) > > Here are my numbers from yesterday based on 24462 processed messages > > Date Test SS SH HH > HS IMP > 0605 SNIFFER-TRAVEL 12 0 0 23 2 > 0605 SNIFFER-INSUR 4 0 0 0 0 > 0605 SNIFFER-AV 0 0 0 > 0 0 > 0605 SNIFFER-MEDIA 1345 0 0 0 8 > 0605 SNIFFER-SWARE 73 0 0 0 0 > 0605 SNIFFER-SNAKE 8386 0 0 0 9 > 0605 SNIFFER-SCAMS 138 0 0 2 3 > 0605 SNIFFER-PORN 908 0 0 1 3 > 0605 SNIFFER-MALWARE 12 0 0 2 3 > 0605 SNIFFER-INK 2 0 0 > 0 0 > 0605 SNIFFER-RICH 2865 0 0 2 219 > 0605 SNIFFER-CREDIT 363 0 0 0 1 > 0605 SNIFFER-CASINO 300 0 0 0 0 > 0605 SNIFFER-GENERAL 2881 0 0 41 41 > 0605 SNIFFER-EXP-A 450 0 0 36 7 > 0605 SNIFFER-OBFUSC 4 0 0 5 0 > 0605 SNIFFER-EXP-IP 28 0 0 8 5 > > > SS Sniffer says spam, final result too > SH Sniffer says spam, final result not > HH Sniffer says ham, final result too > HS Sniffer says ham, final result not > > IMP Sniffer says spam and final result is slight above the > hold weight. > (This column is a part of the SS-column: 100-150% of hold) > So > a.) it's an important test because it's able to bring > the spam above the hold > weight and without this test it wasn't hold as spam. > or > b.) it's a risky test because it brings legit messages > above the hold weight > > What result codes are you using in your test configuration? > (please not publish your sniffer-id!) > > Markus > > > > > > -----Ursprüngliche Nachricht----- > > Von: Message Sniffer Community > > [mailto:[EMAIL PROTECTED] Im Auftrag von David Waller > > Gesendet: Dienstag, 6. Juni 2006 11:51 > > An: Message Sniffer Community > > Betreff: Re: [sniffer]AW: [sniffer]Concerned about amount of spam > > going through > > > > Of all SPAM identified SNIFFER is finding about 30%. We see > an awful > > lot of junk email not being caught by SNIFFER, it's being > processed by > > Declude and failing some technical tests but not by SNIFFER. > > > > -----Original Message----- > > From: Message Sniffer Community > > [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler > > Sent: 06 June 2006 09:41 > > To: Message Sniffer Community > > Subject: [sniffer]AW: [sniffer]Concerned about amount of spam going > > through > > > > > I only see Sniffer catching about 30% of SPAM and that's > > the highest > > > it's ever been. > > > > 30% of spam or 30% of all processed messages? > > Sniffer is still one of the best tests in my arsenal. > > > > Markus > > > > > > > > ############################################################# > > This message is sent to you because you are subscribed to > > the mailing list <[email protected]>. > > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To > switch to > > the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch > > to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > > administrative queries to <[EMAIL PROTECTED]> > > > > > > > > > > ############################################################# > > This message is sent to you because you are subscribed to > > the mailing list <[email protected]>. > > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To > switch to > > the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch > > to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > > administrative queries to <[EMAIL PROTECTED]> > > > > > > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <[email protected]>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to > <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> > > > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <[email protected]>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to > <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> > > ############################################################# This message is sent to you because you are subscribed to the mailing list <[email protected]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
