It could be useful.  You might use this for instances where you are mixing types or tests in one filter file where scores could be different but multiple hits shouldn't occur.  For instance, if you filtered for both an IP address as the HELO and a dashed reverse DNS entry as the HELO in the same filter, you might score the IP higher than the dashed entry, and only one hit should occur, i.e.

MAXWEIGHT   8

HELO      8      CONTAINS      .20.
HELO      8      CONTAINS      .21.
HELO      8      CONTAINS      .22.
HELO      8      CONTAINS      .23.
...

MAXWEIGHT   5

HELO   5      CONTAINS      -20-
HELO   5      CONTAINS      -21-
HELO   5      CONTAINS      -22-
HELO   5      CONTAINS      -23-

So if a hit for an IP failed the first set of tests, a score of 8 would end the processing of the filter, if no hit occurred, it would move on, adjust the MAXWEIGHT to 5, and possibly hit a dashed IP in the HELO for a lower score.  I suppose that this would also work in reverse and it might even be a better design to do it that way because lower scoring false positives are better and I suppose that a HELO could hit both of these (my own personal filter uses END statements to protect from non-IP's in that filter though).  It would be more efficient to have the dashed stuff up top though because it hits more often and that would save a modicum of processing power.

Matt



Scott Fisher wrote:
It does look like the maxweight's can be changed in a filter.

test filter:
maxweight 5
SUBJECT 5 CONTAINS SCOTTFISHER1
maxweight 10
SUBJECT 10 CONTAINS SCOTTFISHER2
maxweight 5
SUBJECT 15 CONTAINS SCOTTFISHER3

e-mail 1 contained SCOTTFISHER1 and scored 5
e-mail 2 contained SCOTTFISHER2 and scored 10
e-mail 3 contained SCOTTFISHER3 and scored 5

Now is this useful?

Scott Fisher
Director of IT
Farm Progress Companies

  
[EMAIL PROTECTED] 05/21/04 10:30AM >>>
        
Can the maxweight / minweight be changed in the middle of a filter?

I can't really think of a reason to use it, just curious.

maxweight 3
subject 5 contains URGENT REQUEST

maxweight 6
body 10 contains NIGERIAN OIL COMPANY

Scott Fisher
Director of IT
Farm Progress Companies

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  

-- 
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================

Reply via email to