On Thu, Mar 16, 2006 at 09:28:11PM -0500, Barry Callahan wrote: > >58.171 62.4003 34.8556 0.642 0.82 0.01 T_RECEIVED_COUNT_01 > >I did up a quick check to gather some stats from my corpus (last 14 days). > Interesting. I don't seem to have that rule. Which ruleset is it in? > I used grep to search for "RECEIVED_COUNT" in all of my installed > rulesets, and it didn't find anything.
Yeah, as I said, I did up a quick check (rule) to gather the stats. There's no default rule for the count of received headers. I used a short plugin, but you could probably do something like: header __EXIST_RECEIVED exists:Received meta NO_RECEIVED !__EXIST_RECEIVED if you dont care about the count and just care if any headers exist. (warning: I haven't tested this, and I would still think you'd see at least 1 from your own box) Just for grins, here's the full set of results I found: 0.145 0.0342 0.7549 0.043 1.00 0.01 T_RECEIVED_COUNT_09 1.278 0.9516 3.0761 0.236 0.97 0.01 T_RECEIVED_COUNT_04 0.467 0.2191 1.8305 0.107 0.94 0.01 T_RECEIVED_COUNT_06 0.000 0.0000 0.0000 0.500 0.85 0.01 T_RECEIVED_COUNT_15 0.000 0.0000 0.0000 0.500 0.85 0.01 T_RECEIVED_COUNT_14 58.171 62.4003 34.8556 0.642 0.82 0.01 T_RECEIVED_COUNT_01 31.966 32.7354 27.7222 0.541 0.79 0.01 T_RECEIVED_COUNT_02 5.540 3.4539 17.0410 0.169 0.76 0.01 T_RECEIVED_COUNT_03 0.159 0.0171 0.9436 0.018 0.74 0.01 T_RECEIVED_COUNT_10 0.003 0.0000 0.0189 0.000 0.74 0.01 T_RECEIVED_COUNT_13 0.072 0.0034 0.4529 0.008 0.65 0.01 T_RECEIVED_COUNT_12 0.006 0.0000 0.0377 0.000 0.62 0.01 T_RECEIVED_COUNT_16 0.797 0.1643 4.2838 0.037 0.56 0.01 T_RECEIVED_COUNT_05 0.087 0.0000 0.5661 0.000 0.38 0.01 T_RECEIVED_COUNT_11 0.264 0.0068 1.6796 0.004 0.32 0.01 T_RECEIVED_COUNT_07 1.046 0.0137 6.7371 0.002 0.00 0.01 T_RECEIVED_COUNT_08 -- Randomly Generated Tagline: "Now that Windows NT 5.0 has been renamed Windows 2000, we should reconsider the rumor that the number that appears after the word 'Windows' is a minimum memory requirement in megabytes." - Craig Milo Rogers
pgpNDaLlGACB3.pgp
Description: PGP signature
