Mediratta, Bharat
bharat@fusionone.com
Wed, 5 Sep 2001 12:22:40 -0700
This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C13640.21419EC0 Content-Type: text/plain; charset="iso-8859-1" > 1056 reports 0>10 0>100 0>1000 39 many > answers 385>10 107>100 0>1000 102 many > That says that in the 10.5 hours starting from 9:30 am until > about 8 pm, my server has received 1056 reports of the checksums of > messages. Of those, 385 or 36% look like spam because they have > addressee counts above 10. (10 is a reasonable threshold for my vanity > domain, and for the other clients of my DCC server, all of which seem > similar.) Assuming that a substantial fraction of the remaing 64% were > not spam implies a much better than 25% effectiveness against the spam > seen around here. So this means that 385 of the messages had at least one metric that was greater than 10? After reading the dcc man page (at the end of the "Client Tools" section), I set my criteria for determining spam to be if one of Message-ID, Received, Body or Fuz1 had a count greater than 10. So, is there any way of telling how many of those 385 hits included those 4 criteria? -Bharat ------_=_NextPart_001_01C13640.21419EC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Diso-8859-1"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 5.5.2653.12"> <TITLE>RE: 25% spam hit rates</TITLE> </HEAD> <BODY> <P><FONT SIZE=3D2>> 1056 reports = 0>10 = 0>100 0>1000 39 = many</FONT> <BR><FONT SIZE=3D2>> = answers 385>10 = 107>100 0>1000 102 = many </FONT> </P> <P><FONT SIZE=3D2>> That says that in the 10.5 hours starting from = 9:30 am until </FONT> <BR><FONT SIZE=3D2>> about 8 pm, my server has received 1056 reports = of the checksums of </FONT> <BR><FONT SIZE=3D2>> messages. Of those, 385 or 36% look like = spam because they have </FONT> <BR><FONT SIZE=3D2>> addressee counts above 10. (10 is a = reasonable threshold for my vanity </FONT> <BR><FONT SIZE=3D2>> domain, and for the other clients of my DCC = server, all of which seem </FONT> <BR><FONT SIZE=3D2>> similar.) Assuming that a substantial = fraction of the remaing 64% were </FONT> <BR><FONT SIZE=3D2>> not spam implies a much better than 25% = effectiveness against the spam </FONT> <BR><FONT SIZE=3D2>> seen around here.</FONT> </P> <P><FONT SIZE=3D2>So this means that 385 of the messages had at least = one metric that</FONT> <BR><FONT SIZE=3D2>was greater than 10? After reading the dcc man = page (at the end of </FONT> <BR><FONT SIZE=3D2>the "Client Tools" section), I set my = criteria for determining spam </FONT> <BR><FONT SIZE=3D2>to be if one of Message-ID, Received, Body or Fuz1 = had a count greater </FONT> <BR><FONT SIZE=3D2>than 10. </FONT> </P> <P><FONT SIZE=3D2>So, is there any way of telling how many of those 385 = hits included</FONT> <BR><FONT SIZE=3D2>those 4 criteria? </FONT> </P> <P><FONT SIZE=3D2>-Bharat</FONT> </P> </BODY> </HTML> ------_=_NextPart_001_01C13640.21419EC0--