Here's what I use: My subject tag weight is 100 points. So in general sniffer weighs in at 90%. The greymail (60) needs some taming. I run a greymail whitelist to credit back 42 points to those that I don't consider spam. That's the only code you really need to be wary of. You may tend to get a few more false positives in the experimental (62) category, so if you wanted to weight that one less. On the other hand it is likely to catch the newest spam.
I find having return code 0 helps. When I encounter a spam that has the sniffer-notfound in the headers, it gets forwarded to sortmonster. SNIFFER-NOTFOUND external 000 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 0 0 SNIFFER-TRAVEL external 047 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-INSURANCE external 048 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-AV-PUSH external 049 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-WAREZ external 050 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-SPAMWARE external 051 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-SNAKEOIL external 052 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-SCAMS external 053 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-PORN external 054 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-MALWARE external 055 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-ADVERTISING external 056 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-SCHEMES external 057 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-CREDIT external 058 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-GAMBLING external 059 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-GREYMAIL external 060 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 42 0 SNIFFER-OBFUSCATION external 061 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-EXPERIMENTAL external 062 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 SNIFFER-GENERAL external 063 "D:\IMail\Declude\Sniffer\sniffer2.exe code" 90 0 Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 06/14/04 11:14AM >>> I am new to Sniffer, and have it up and running with the basic line looking for a nonzero return code. I would now like to start setting different weights for different return codes. Does some one have a example configuration I can use? John Tolmachoff Engineer/Consultant/Owner eServices For You This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
