25% spam hit rates

> From: "Mediratta, Bharat" <bharat@fusionone.com>

> ...
> >    1056 reports    0>10        0>100      0>1000    39 many
> >        answers   385>10      107>100      0>1000   102 many   

> ...
> So this means that 385 of the messages had at least one metric that
> was greater than 10?

Yes.

>                       After reading the dcc man page (at the end of 
> the "Client Tools" section), I set my criteria for determining spam 
> to be if one of Message-ID, Received, Body or Fuz1 had a count greater 
> than 10.  
>
> So, is there any way of telling how many of those 385 hits included
> those 4 criteria?  

No, the "answers" accumulate the number of DCC responses with a maximum
value among the checksum counts of at least 10, 100, and so forth.
However, unless you get much legitimate bulk mail, you shouldn't see
much mail with large counts among the Subject, From, and so forth but
small body counts.  In other words, my guess that most of those
385 hits are of spam.


`dccproc -QC` can be useful for asking remote servers about counts.

`cdcc "pck ..."` and `dblist -v |grep -5 ....` are useful for examining
a local checksum database.


Vernon Schryver    vjs@rhyolite.com