RE: Re[2]: [sniffer] POP3 Account Question

[Colbeck, Andrew]

Thanks, Pete.

 

That answers my question and makes good sense.  I've been testing my own trap reporting and Scott's timing couldn't have been better.

 

Andrew 8)

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
Sent: Monday, December 05, 2005 2:21 PM
To: Colbeck, Andrew
Subject: Re[2]: [sniffer] POP3 Account Question

On Monday, December 5, 2005, 3:38:14 PM, Andrew wrote:

>

(nuts, to fast on the "Send" button).   ... plus, future hits on spam that is already detected can accumulate hits on, say, SNIFFEREXPIP that weren't already hitting.  Therefore, trying to save bandwidth and processing power over at sortmonster.com by submitting less spam is not helpful.   Pete, how'd I do?  .

We're ok for bandwidth - but no need to spend yours on bandwidth that's not necessary. Outbound bandwidth is more frequently billable than inbound bandwidth (IME). We always want this to be as painless as possible for you ;-)

As for waking up dormant rules (I think that's what you were getting at), the way it would work is: If the rule is dormant in your rulebase, then it would not match SNF... so, in theory the message would get through to your trap and would get picked up by the Trap-Bot. The Trap-Bots use fullbase to scan inbound spam. That contains ALL of the rules (at present > 620000!), dormant or not, so the message getting through would cause a hit - and that would raise the strength and reactivate the rule. Additional activity from reported logs (or additional instances in traps) would push a rule's strength over the standard threshold (1.0) very quickly --- say after only 30 messages or so.

Hope this helps,

_M

This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html