Andrew >Are you using the free version of sniffer? Or did you deliberately change your .exe name in your posting to sniffer.exe to hide your licence number?
:) Yes >I certainly expect that the rulebase lag with the free version will result in lower Message Sniffer hit rates. >I've seen the free version with hit rates as low as 10% on the remaining messages that have been already filtered by a gateway, which I thought was still decent because these were the messages that had already evaded the blacklist tests. And free is good. That's the problem. I'm not using the free version but am still getting what I consider to be poor results, poor enough to consider whether it's worth the outlay. I don't often get SNIFFER solely detecting junkmail that other tests haven't found. Part of the problem may lie with Declude as some SPAM seem to completley bypass Declude (but that's only a small fraction of the total). Regards David > -----Original Message----- > From: Message Sniffer Community > [mailto:[EMAIL PROTECTED] On Behalf Of David Waller > Sent: Tuesday, June 06, 2006 5:46 AM > To: Message Sniffer Community > Subject: Re: [sniffer]AW: [sniffer]AW: [sniffer]Concerned about amount > of spam going through > > We just use a single test, we don't categorise. If SNIFFER returns a > result we weight it. However, SNIFFER oftens returns a zero result > when the email is obviously junk i.e. > SNIFFER returns a positive result (spam) in about 30% of all > identified junk mail. > > SNIFFER external nonzero "\declude\sniffer\sniffer.exe" 23 0 > > > -----Original Message----- > From: Message Sniffer Community > [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: 06 June 2006 11:17 > To: Message Sniffer Community > Subject: [sniffer]AW: [sniffer]AW: [sniffer]Concerned about amount of > spam going through > > Hi > > There mus be something wrong with your configuration of the sniffer > test(s) > > Here are my numbers from yesterday based on 24462 processed messages > > Date Test SS SH HH > HS IMP > 0605 SNIFFER-TRAVEL 12 0 0 23 2 > 0605 SNIFFER-INSUR 4 0 0 0 0 > 0605 SNIFFER-AV 0 0 0 > 0 0 > 0605 SNIFFER-MEDIA 1345 0 0 0 8 > 0605 SNIFFER-SWARE 73 0 0 0 0 > 0605 SNIFFER-SNAKE 8386 0 0 0 9 > 0605 SNIFFER-SCAMS 138 0 0 2 3 > 0605 SNIFFER-PORN 908 0 0 1 3 > 0605 SNIFFER-MALWARE 12 0 0 2 3 > 0605 SNIFFER-INK 2 0 0 > 0 0 > 0605 SNIFFER-RICH 2865 0 0 2 219 > 0605 SNIFFER-CREDIT 363 0 0 0 1 > 0605 SNIFFER-CASINO 300 0 0 0 0 > 0605 SNIFFER-GENERAL 2881 0 0 41 41 > 0605 SNIFFER-EXP-A 450 0 0 36 7 > 0605 SNIFFER-OBFUSC 4 0 0 5 0 > 0605 SNIFFER-EXP-IP 28 0 0 8 5 > > > SS Sniffer says spam, final result too > SH Sniffer says spam, final result not > HH Sniffer says ham, final result too > HS Sniffer says ham, final result not > > IMP Sniffer says spam and final result is slight above the > hold weight. > (This column is a part of the SS-column: 100-150% of hold) > So > a.) it's an important test because it's able to bring the spam above > the hold > weight and without this test it wasn't hold as spam. > or > b.) it's a risky test because it brings legit messages above the hold > weight > > What result codes are you using in your test configuration? > (please not publish your sniffer-id!) > > Markus > > > > > > -----Ursprüngliche Nachricht----- > > Von: Message Sniffer Community > > [mailto:[EMAIL PROTECTED] Im Auftrag von David Waller > > Gesendet: Dienstag, 6. Juni 2006 11:51 > > An: Message Sniffer Community > > Betreff: Re: [sniffer]AW: [sniffer]Concerned about amount of spam > > going through > > > > Of all SPAM identified SNIFFER is finding about 30%. We see > an awful > > lot of junk email not being caught by SNIFFER, it's being > processed by > > Declude and failing some technical tests but not by SNIFFER. > > > > -----Original Message----- > > From: Message Sniffer Community > > [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler > > Sent: 06 June 2006 09:41 > > To: Message Sniffer Community > > Subject: [sniffer]AW: [sniffer]Concerned about amount of spam going > > through > > > > > I only see Sniffer catching about 30% of SPAM and that's > > the highest > > > it's ever been. > > > > 30% of spam or 30% of all processed messages? > > Sniffer is still one of the best tests in my arsenal. > > > > Markus > > > > > > > > ############################################################# > > This message is sent to you because you are subscribed to > > the mailing list <sniffer@sortmonster.com>. > > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To > switch to > > the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch > > to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > > administrative queries to <[EMAIL PROTECTED]> > > > > > > > > > > ############################################################# > > This message is sent to you because you are subscribed to > > the mailing list <sniffer@sortmonster.com>. > > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To > switch to > > the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch > > to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > > administrative queries to <[EMAIL PROTECTED]> > > > > > > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <sniffer@sortmonster.com>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to > the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch > to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > administrative queries to <[EMAIL PROTECTED]> > > > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <sniffer@sortmonster.com>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to > the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch > to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send > administrative queries to <[EMAIL PROTECTED]> > > ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]> ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
