Using and Understanding DCC

Contact vjs@rhyolite.com by mail or use the form. · Wed Jan 7 15:07:23 UTC 2004

Hi fellow DCC users,

I was hoping to gain a bit of understanding on how to best configure and 
use DCC in my company. I understand the concept of DCC, how it works
by creating a digital checksum of certain parts of an email message (I 
think). However what I do not understand is what those parts are.. Can someone
enlighten me please.

Also, I would like to ask a question about this statement from the the DCC 
website.

"Because simplistic checksums of spam would not be effective, the main DCC 
checksums are fuzzy and ignore aspects of messages. The fuzzy checksums are 
changed as spam evolves. Since the DCC started being used in production in 
late 2000, modified checksums have been developed several times."

What does it mean that the checksums are "fuzzy" and which aspects of a 
message are ignored.

Also, I have DCC set to log messages that have a count of 5. The logging is 
done in /var/dcc/log and here is a sample file:

VERSION: 3
DATE: 12/31/03 23:42:13 EST
IP: modemcable015.209-200-24.mc.videotron.ca ::ffff:24.200.209.15
HELO: mgmt.ucalgary.ca
env_From: <a_story_se@omantel.net.om>  mail_host=omantel.net.om.
env_To: 
<oldave@enhtech.com>  addr=oldave@enhtech.com 
dir=userdirs/esmtp/oldave@enhtech.com

Date: Thu, 01 Jan 2004 04:54:25 +0000
To: oldave@enhtech.com
MIME-Version: 1.0
X-Mailer: Pegasus Mail for Win32 (v3.12a)
From: "Augustus Story" <a_story_se@omantel.net.om>
Message-ID: <1072932865.1542@omantel.net.om>
Subject: =?ISO-8859-1?B?QSByZWZlcmFsIGZyb20geW91ciBmcmllbmRz?=
Content-Type: multipart/alternative;
         boundary="----=_NextPart_000_02D9_D5A77DC1.3CF4EBA2"

This is a multi-part message in MIME format.

------=_NextPart_000_02D9_D5A77DC1.3CF4EBA2
Content-Type: text/plain;
         charset="us-ascii"
Content-Transfer-Encoding: 8bit

------=_NextPart_000_02D9_D5A77DC1.3CF4EBA2
Content-Type: text/html;
         charset="us-ascii"
Content-Transfer-Encoding: 8bit

<html><body>
<center><!--m6egr41zlqxc0--><a 
href="http://www.34ex4.com/ghr/?aff=2&cac=mas3"><!--srAprNqNlI1q--><img 
src="http://www.lexrtrt.com/g9.gif" border=0></a></center>
</html></body>

------=_NextPart_000_02D9_D5A77DC1.3CF4EBA2--

### end of message body ########################

X-DCC-sgs_public_dcc_server-Metrics: server21.enhtech.com 1199; Body=1 Fuz1=1
         Fuz2=many
                                                       checksum  server
                        IP: 0c0d0a15 04b8c3fd 89c7a401 f9560f28
                  env_From: 4e7f4c0b 4bea8280 0e6bce40 96c5b90d
                      From: 466d12af 6b54b120 9468dc09 6650b560
                Message-ID: ea473dd0 8311631c bcb484d1 169ea530
                      Body: 2ab1d754 78dfe9ca c6a7e5af 4c67df8c       0
                      Fuz1: 0e44e8e1 74317bb9 964cc342 a32c323f       0
                      Fuz2: 25b5a631 fd7f65e1 158d66da 7ac02cc1    many

result: accept

My question is are the "counts" made on the Body, Fuz1 and Fuz2? Is it a 
total, ie Body+Fuz1+Fuz2 or which every scores 5? Secondly, what are the 
Fuzz* checksums?

I really hope someone can help me understand.

Best Regards,

Errol Neal

Errol U. Neal Jr., Systems Administrator
Enhanced Technologies, Inc. - The Business Grade Hosting Specialists
http://www.enhtech.com
703-924-0301 or 800-368-3249
703-997-0839 Fax