From: "John D. Hardin" <[EMAIL PROTECTED]>

On Sun, 13 Aug 2006, Benny Pedersen wrote:

On Sun, August 13, 2006 02:11, John D. Hardin wrote:
> On Sat, 12 Aug 2006, John Rudd wrote:
>
> 127.0.0.1 ... 127.0.0.100 perhaps? How would a rule to score points
> based on the returned IP look? Can/does SA cache the returned IP and
> test it in multiple rules without making multiple DNS queries?

yes, i have created an example.cf to SA

Good.

...is there any way to write a rule that mathematically bases the
score points on the IP returned, without having 100 rules (one for
each score point)?

Of course - look at the Bayes rules and "eval".

{^_-}

Reply via email to