I'm using Postfix 2.4.6, Amavisd-new 2.5.2, ClamAV 0.91.2 and Mail-SpamAssassin 3.2.3 in a Linux mail filter. I've also implemented Passive OS Fingerprinting using the instructions written by Mark and have been pleased with P0Fs contributions.
It seems to me that P0F would be more valuable if it could discern between a desktop OS and a server. On my system anyway, P0F appears to lump Windows 2000, Windows XP and Windows Server 2003 all together. Is it possible for P0F to distinguish between Windows XP and Windows Server 2003 IP stacks? That would be very helpful. Also, I noticed SPAM slipping by originating from The Bat! and that P0F did not recognize the IP stack signatrure. I don't know much about The Bat! except that it is frequently used to send mass e-mailings. What OS does The Bat! run under? Does it include it's own IP stack? If a P0F signature can be developed for Thhe Bat!, I would think that would be helpful too. Following is a sample. I don't have a clue what all of the numbers following "UNKNOWN" mean. Ken Morley >From [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> Mon Dec 17 18:42:02 2007 X-Original-To: postmaster <mailto:[EMAIL PROTECTED]> @private_domain Delivered-To: postmaster <mailto:[EMAIL PROTECTED]> @private_domain X-Virus-Scanned: by amavisd-new using ClamAV at private_domain X-Spam-Flag: NO X-Spam-Score: 3.949 X-Spam-Level: *** X-Spam-Status: No, score=3.949 tagged_above=3 required=5 tests=[BAYES_50=0.001, DCC_CHECK=2.17, HTML_MESSAGE=0.001, L_P0F_UNKN=0.8, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1] X-Amavis-OS-Fingerprint: UNKNOWN [65535:52:1:52:M1364,N,W3,N,N,S:.:?:?], (link: unknown-1404), [189.15.220.184] Date: Tue, 18 Dec 2007 00:49:29 +0000 From: "Behlmer Cherrez" <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > X-Mailer: The Bat! (3.62.09) Professional Reply-To: Behlmer Cherrez <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > X-Priority: 3 (Normal) To: user <mailto:[EMAIL PROTECTED]> @private_domain Subject: consoling MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----------372B7EDE864719" ------------372B7EDE864719 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Hej, =20 Downlooadable Softwaree=20 http://www.geocities.com/wpn3iof2b2qg13g/=09 A special point of practice: they circumcise themselves western railway in regard to goods despatched legend, set the damsel asneezing violently, an man who was a bosom friend of the sparrow. But allow him to come out alone. My friend rose lazily take again.' and ere the schoolmaster could call and also another which, on coming down a steep course you ------------------------------------------------------------------------- SF.Net email is sponsored by: Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
