false negative at dcc2.sinectis.com.ar

Leandro Santi lesanti@uolsinectis.com.ar
Wed Mar 19 23:03:05 UTC 2003


Hi,

I received a false negative today. My copy was processed by server
dcc2.sinectis.com.ar:

dcc2>> dccproc -QC </tmp/spam/mail6
X-DCC-UOLCC-Metrics: jeeves 1112; Body=3 Fuz1=3 Fuz2=45
                                                      checksum  server
                 env_From: fe876a7c 9461ace7 f2c913f8 6e89c6bb       0
                     From: a77b0fee 4e717743 0348c65e 2abc4c98       0
               Message-ID: 4c44d5b4 84b0ea51 ede6ec27 414af347       0
                 Received: 9b0e72be bb968221 d53df584 1769f3da       0
                     Body: e08f47fe f82c79c6 ef25382a 50ec7b8b       3
                     Fuz1: 06d63538 56edda57 f08106ba 16ee9c32       3
                     Fuz2: 5f03f09e fdf33dc4 df92c369 ccd7d3e8      45

Strangely, dcc1.sinectis.com.ar is reporting it as "many",

dcc1>> dccproc -QC < /tmp/spam/mail6
X-DCC-UOLCC-Metrics: glossop.sinectis.com.ar 1111; Body=1 Fuz1=1 Fuz2=many
                                                      checksum  server
                 env_From: fe876a7c 9461ace7 f2c913f8 6e89c6bb       0
                     From: a77b0fee 4e717743 0348c65e 2abc4c98       0
               Message-ID: 4c44d5b4 84b0ea51 ede6ec27 414af347       0
                 Received: 9b0e72be bb968221 d53df584 1769f3da       0
                     Body: e08f47fe f82c79c6 ef25382a 50ec7b8b       1
                     Fuz1: 06d63538 56edda57 f08106ba 16ee9c32       1
                     Fuz2: 5f03f09e fdf33dc4 df92c369 ccd7d3e8    many

These DCC servers flood against each other, but this particular report
isn't being flooded. I tried to trace the problem using dblist,

dcc1>> /var/dcc/libexec/dblist -C 'Fuz2 5f03f09e fdf33dc4 df92c369 ccd7d3e8'
...
03/19/03 13:09:34.797048    19       1109                     97773b4
     path: 1107<-1116<-1115<-
  Fuz2         many       5f03f09e fdf33dc4 df92c369 ccd7d3e8  966e868 1c98c0

So it seems to me that dcc1.sinectis.com.ar got the report from the
1115->1116->1107 chain. But dcc2 doesn't seem to get it:

dcc2>> /var/dcc/libexec/dblist -C 'Fuz2 5f03f09e fdf33dc4 df92c369 ccd7d3e8'
...
03/19/03 19:18:50.579760    1        1112       delayed       a417cc8
  Body         1          2c1ea869 1b15acd9 fb68af25 a093dcd4          31119d
  Fuz1         1          fa160bf9 e169113e 7a076e3f 45e65616          332f83
  Fuz2         44         5f03f09e fdf33dc4 df92c369 ccd7d3e8  a399d7c 1e121b

I'd expect dcc2 to get this spam report via the 1115->1116->1107->1111
chain. Is this OK? Any ideas?

Thanks,
Leandro




More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.