|
It could be useful. You might use this for instances where you are
mixing types or tests in one filter file where scores could be
different but multiple hits shouldn't occur. For instance, if you
filtered for both an IP address as the HELO and a dashed reverse DNS
entry as the HELO in the same filter, you might score the IP higher
than the dashed entry, and only one hit should occur, i.e. MAXWEIGHT 8 HELO 8 CONTAINS .20. HELO 8 CONTAINS .21. HELO 8 CONTAINS .22. HELO 8 CONTAINS .23. ... MAXWEIGHT 5 HELO 5 CONTAINS -20- HELO 5 CONTAINS -21- HELO 5 CONTAINS -22- HELO 5 CONTAINS -23- So if a hit for an IP failed the first set of tests, a score of 8 would end the processing of the filter, if no hit occurred, it would move on, adjust the MAXWEIGHT to 5, and possibly hit a dashed IP in the HELO for a lower score. I suppose that this would also work in reverse and it might even be a better design to do it that way because lower scoring false positives are better and I suppose that a HELO could hit both of these (my own personal filter uses END statements to protect from non-IP's in that filter though). It would be more efficient to have the dashed stuff up top though because it hits more often and that would save a modicum of processing power. Matt Scott Fisher wrote: It does look like the maxweight's can be changed in a filter. test filter: maxweight 5 SUBJECT 5 CONTAINS SCOTTFISHER1 maxweight 10 SUBJECT 10 CONTAINS SCOTTFISHER2 maxweight 5 SUBJECT 15 CONTAINS SCOTTFISHER3e-mail 1 contained SCOTTFISHER1 and scored 5 e-mail 2 contained SCOTTFISHER2 and scored 10 e-mail 3 contained SCOTTFISHER3 and scored 5 Now is this useful? Scott Fisher Director of IT Farm Progress Companies[EMAIL PROTECTED] 05/21/04 10:30AM >>>Can the maxweight / minweight be changed in the middle of a filter? I can't really think of a reason to use it, just curious. maxweight 3 subject 5 contains URGENT REQUEST maxweight 6 body 10 contains NIGERIAN OIL COMPANY Scott Fisher Director of IT Farm Progress Companies --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== |
- [Declude.JunkMail] maxweight/minweight question Scott Fisher
- Re: [Declude.JunkMail] maxweight/minweight quest... System Administrator
- Re: [Declude.JunkMail] maxweight/minweight quest... Scott Fisher
- Re: [Declude.JunkMail] maxweight/minweight q... System Administrator
- Re: [Declude.JunkMail] maxweight/minweight quest... Scott Fisher
- Re: [Declude.JunkMail] trip Matt
- Re: [Declude.JunkMail] trip Nick Hayer
- Re: [Declude.JunkMail] trip R. Scott Perry
- RE: [Declude.JunkMail] trip Keith Purtell
