Hi Pete, Other question.
The SNFIP tests return Caution or Black or Caution. And the SNF client exit codes also have Truncate/Black. But your documentation of the reputation system has a graph that shows that there is yet another category: "WHITE". I don't see this represented as an SNFIP or SNF rule? Any reason why "WHITE" was left out? The SNFIPREP tests does offer the ability to define at what decimal value (between -1 and +1, in .1 increments) a weight can be subtracted. But the question is - is that SENSIBLE use of your reputation database? Per example, could -0.8 be a sensible threshold to give an email "credit" for coming from a reputable IP source? Or is it better to let the "good" reputation be considered AFTER the content scan and then use the "combined" exit code? -----Original Message----- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Pete McNeil Sent: Friday, April 30, 2010 7:07 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] Sniffer IP vs. Sniffer IP Reputation vs. Sniffer Truncate On 4/30/2010 5:16 PM, Andy Schmidt wrote: > Hi Pete, > > I'm look over Decludes recommended Sniffer configuration and trying to > understand how much overlap there is between these options: > > IPREPUTATION SNFIPREP x 0 10 -5 > > SNFIPCAUTION SNFIP x 4 5 0 > SNFIPBLACK SNFIP x 5 10 > 0 > SNFIPTRUNCATE SNFIP x 6 10 0 > > SNFTRUNCATE SNF x 20 10 > 0 > SNIFFER-IP-RULES SNF x 63 10 > 0 > > Looking at the Sniffer documentation IP test result codes > http://www.armresearch.com/support/articles/software/snfClient/resultCodes.j > sp > it seems that the SNFIP tests for "4", "5" and "6" (SNFIPCAUTION, > SNFIPBLACK, SNFIPTRUNCATE) might coincide with 40, 63 and 20. > I am not intimately familiar with Declude's configuration and SNF integration --- not like I used to be anyway (soooo many platforms now). I _think_ these tests work like this: The SNFIPREP test gives you a variable weight based on the IP reputation in GBUdb. This allows you to get some weighting positively or negatively based on the reputation even when that reputation is not in one of the defined GBUdb envelopes. It's a subtle nudge in the right direction. The SNFIP test gives you a hard result code based only on the IP reputation when that reputation is within one of the envelopes defined for GBUdb. So if the IP reputation is in the Caution, Black, or Truncate range then that test will fire. Presumably all of the IP tests happen before SNF scans the message -- because they can -- I don't know that they do, but I know that IP reputations can be queried before and separately from a scan. (Scans MUST happen in order for GBUdb to build up reputation data however). Finally the SNF test responds to the normal blended result codes that SNFClient would return. So result code 20 is Truncate- meaning that the IP reputation was so bad that SNF stopped the scan and returned the result code. Result code 63 is Black which could mean that an SNF IP rule fired (rare these days) or that no pattern matched but the IP was in the Black range in GBUdb so GBUdb took over and forced the result code from 0 (no pattern found) to 63 (Black). Other result codes are also possible: http://www.armresearch.com/support/articles/software/snfClient/resultCodes.j sp#msgScan David -- if I got any of this wrong please correct me. > However, Declude ALSO tests for your Rule Group Result Codes "20" and "63" > which are documented here: > http://www.armresearch.com/support/articles/software/snfServer/core.jsp > > 1. It seems to me, as if their SNFTRUNCATE is the same as their > SNFIPTRUNCATE, and their SNIFFER-IP-RULES is the same as their SNFIPBLACK -- > effectively artificially inflating (doubling) the weights for these tests? > Yes -- if you have them configured that way. Some of the results are predictable. If SNFIP is Black or Caution then you are virutally guaranteed to get a Black or Caution result from SNF -- Unless SNF matches a pattern in which case you will get a pattern result code from the SNF test. If SNFIP is Truncate then SNF should also return Truncate. The weights you assign to these should be set accordingly. > 2. How do those Caution/Black/Truncate exit codes relate to SNFIPREP. > There, any reputation> 0 (up to 1) is given an extra weight of 10. But > doesn't SNFIPREP report from the same reputation data as the SNFIP (and > possibly even group result codes 20 and 63)? In other words, are those IP > addresses that generate a reputation factor of> 0 ALSO reported as > Caution/Black or Truncate - if so, we'd now TRIPLE count that score. > That's not quite true... I presume the SNFIPREP test uses a sliding numeric value that combines the probability factor and the confidence factor for the IP. This is not the same thing as Caution, Black, and Truncate. The SNFIPREP result is a sliding value that will work even when the reputation is not in the (White) Caution, Black, and Truncate ranges. When an IP's reputation is in one of those ranges then the appropriate result from SNFIP will either be returned or not (On or Off). Now-- I presume that even when SNFIP does return Caution, Black, or Truncate that SNFIPREP continues to work and in that case will provide some shading to those values... so, if you will, more or less Black, etc. I don't think that I would necessarily use all of these together -- though it is possible to do so. It seems to be that it might become very complicated since there is some overlap. That said -- I do think that some of these tests can be combined successfully without too much confusion... it's just a matter of knowing how they interact. Hopefully my description is helpful (and my assumptions are correct). Best, _M -- President MicroNeil Research Corporation www.microneil.com --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
