New DCC install with SA 2.61

Sven Willenberger
Wed Dec 17 18:53:24 UTC 2003

On Tue, 2003-12-16 at 19:42, Alan Munday wrote:
> Thanks for the responses...
> I had use_dcc set which is why I presumed I could see DCC being called when
> I ran SA in debug mode.
> Using the parameters quoted I've traced them in the SA conf help file. 
> I suspect that the major reason I'm not seeing DCC_CHECK scores are the
> default values for body, fuz1 & fuz2 being set to 999999.
> I've turned on dcc_add_header which I suspect will confirm this.
> Can I ask what values other use for:
> dcc_body_max
> dcc_fuz1_max
> dcc_fuz2_max
> Thanks
> Alan

One could presumable use the suggested values listed in the manpage for
dccm. For a smaller site perhaps values of 50 or less, larger sites may
be better with a larger value of 100 or more.

Also, in reference as to whether or not any dcc checks are even being
attempted, one could tcpdump or snoop port 6277 on the box doing the SA
(assuming one has root priveleges) to check for matching outbound and
inbound udp packets.


More information about the DCC mailing list

Contact by mail or use the form.