Significance of all-zero checksum counts

Vernon Schryver vjs@calcite.rhyolite.com
Sun Dec 21 02:39:31 UTC 2003


> From: Gary Mills <mills@cc.UManitoba.CA>

> I've had a few reports from concerned users that they've received
> spam that had all of the DCC checksum counts set to zero.  What does
> this mean?  In the example below, the message is single-part MIME
> with an HTML body:
>
> X-DCC-UofM-Metrics: electra 1032; Body=0 Fuz1=0 Fuz2=0
> ...

That probably means that the DCC client queried the DCC server about
the message instead of reporting it, and DCC server's answer was that
it had never heard of the message.  See -Q in the dccm man page.

Note that if the currently selected DCC server fails to answer any of
the 4 or 5 retransmitted requests sent by a DCC client, the client
will switch once to the next best server.  To avoid double-counting,
the client also switches to querying instead of reporting the checksums
of the message.  This is because the client cannot know why it was not
hearing answers from the first server.  The first server might have
heard the clients's report, incremented the counts for the message's
checksums, and answered the client without the answer reaching the
client.

Thus, I'm guessing that this situation happened when the current
server or communications with the current server hiccupped.
Adding -d to DCCM_ARGS in /var/dcc/dcc_conf should generate
log messages when this happens.


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.