Re: [AMaViS-user] Current p0f rules?

2010-05-20 Thread Andy Dills
On Wed, 19 May 2010, Mark Martinec wrote: > Andy, > > > Are the sample rules in the release notes still the preferred p0f ruleset > > for SA? > > Yes, still valid. It's pretty much what I'm using at our site. > > The IP distance (hop count) rules may need tweaking if your site > is close to

Re: [AMaViS-user] Current p0f rules?

2010-05-19 Thread Mark Martinec
Andy, > Are the sample rules in the release notes still the preferred p0f ruleset > for SA? Yes, still valid. It's pretty much what I'm using at our site. The IP distance (hop count) rules may need tweaking if your site is close to poorly policed ISPs, but it works well in our academic networks

[AMaViS-user] Current p0f rules?

2010-05-10 Thread Andy Dills
Hi there, Are the sample rules in the release notes still the preferred p0f ruleset for SA? Does anybody have any comments or experiences? We're in the process of upgrading amavisd-new, and want to take this opportunity to utilize this additional tool. Thanks, Andy --- Andy Dills Xecunet, I