Jerry, I think I'm in totally agreement with you, except when you said:
>>"SBL-XBL is fine for that." SBL is fine for checking all the headers... but, per my original message, I think that, like PBL, XBL will trigger too many FPs when checked against all IPs in the headers, not just the sending server IP. Sure, the percent of XBL FPs generated wouldn't be nearly as high as PBL, but still too high! Did you mean to say, "SBL is fine for that." ?? Rob McEwen PowerView Systems [EMAIL PROTECTED]