Hello Andrew,
A few minor corrections if I may.
Friday, November 9, 2007, 8:31:01 PM, you wrote:
|
> |
The Ugly value returned by the beta Message Sniffer you're using with the "Good, Bad and Ugly" database has a result code of 40, and this code is missing from your list. |
That's not quite correct.
Ugly is a flag on the IP record (the default) that means the IP is evaluated based on it's statistics.
The default "Caution" range result code is 40. That indicates that the IP is relatively new to the system and that it doesn't look good.
The default "Black" range result code is 63 - just like hard coded IP rules (which are deprecated and will be removed as necessary.)
The default "Truncate" range result code is 20 - which means that the IP was so "black" that the scanner was deactivated once the source IP was determined.
|
> |
(The White value overlaps with result code 0, which internally to Message Sniffer will mask any other "spam" result code on your system. The White return value also indicates "did not find a reason to call this spam", so do not use a return value of zero to reward an email with negative points in your weighting system... because zero means it wasn't hammy, it does not mean that it was hammy).
(The Bad value replaces the existing return value 63, which is "experimental IP"). |
Almost. If you tell GBUdb that an IP is Bad, then you change the flag from Ulgy to Bad and that IP will always result in a "black" result (63) no matter what the statistics are.
---
If you have your system set up to recognize specific result codes from SNF and you have started using the new version (beta 1.5 currently) then you will want to account for 2 new result codes.
40 - which means caution. You may want to weight this about the same as another RBL depending upon how you have things tuned on your system and your results.
20 - which means truncated. You will want to weight this as high as your highest SNF test.
The result code 63 still carries roughly the same meaning-- the IP is black, so the message is spam. There is no need for special treatment with this result code.
Hope this helps,
_M
--
Pete McNeil
Chief Scientist,
Arm Research Labs, LLC.
############################################################# This message is sent to you because you are subscribed to the mailing list <[email protected]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
