Hi,
This is my configurations of the greyscanner:
$SCAN_INTERVAL = 600;
$DNS_SOCK_MAX=50;
$SUSPECT_TUPLES = 6;
$MAX_DOMAINS = 8;
$MAX_SENDERS_RATIO = 0.85;
My idea was to be a bit more conservative than
the default configuration. Is there any inconsistency
in the above set of parameters?
Regards,
Jose
> ----- Original Message -----
> From: "Raimo Niskanen" <[EMAIL PROTECTED]>
> To: "Jose Fragoso" <[EMAIL PROTECTED]>, misc@openbsd.org
> Subject: Re: question about Bob Beck's greyscanner
> Date: Wed, 27 Aug 2008 11:44:20 +0200
>
>
> On Tue, Aug 26, 2008 at 06:04:22PM -0300, Jose Fragoso wrote:
> > Hi,
> >
> > I am running spamd on a OpenBSD 4.1 box with the greyscanner.41 running
every
> > 10 minutes.
> >
> > Recently I noticed the following log entry:
> >
> > Aug 26 15:47:58 gwint greytrapper[11467]: Trapped 91.82.157.211:
> > Senders/Tuples ration is 9/8 senders/tuples (> 0.85)
> >
> > Now my question is how is it possible for the number of senders to be
> > greater than the number of tuples? Or should the script display
> >
> > 8/9 senders/tuples (> 0.85)
>
> The script appears to do it right:
>
> my @senders = split("\t", $FROM{$grey});
> :
> my $count = @senders;
> :
> my %S = undef;
> :
> foreach $s(@senders) {
> $S{"$s"}++;
> :
> }
> :
> my $scount = keys %S;
> :
> } elsif ($scount/$count > $MAX_SENDERS_RATIO) {
> $reason = "Senders/Tuples ration is $scount/$count"
> . " senders/tuples (> $MAX_SENDERS_RATIO)";
>
> $count is number of tuples for a host and $scount is
> number of unique From: addresses among these tuples.
>
> Senders/Tuples of 9/8 should not be possible.
> It is a strange bug...
>
>
> >
> > Thanks in advance for any explanation.
> >
> > Regards,
> >
> > Jose
> >
> >
> > --
> > Be Yourself @ mail.com!
> > Choose From 200+ Email Addresses
> > Get a Free Account at www.mail.com
>
> --
>
> / Raimo Niskanen, Erlang/OTP, Ericsson AB
>
--
Be Yourself @ mail.com!
Choose From 200+ Email Addresses
Get a Free Account at www.mail.com
