Re: IDS engines put this together

[mjr () nfr net (Marcus J. Ranum)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
Greg Shipley wrote:
> Do current NIDS have signatures for SAPMing?

You can have an NFR generate an alert if there are more
than a certain number of RCPT:s for a message. But I
think it'll be hard to come up with a perfect algorithm
for determining spam from desirable bulk mailings. That's
the real trick. We have all the other pieces of the puzzle
except that one.

mjr.

-----
Marcus J. Ranum
Chief Technology Officer, Network Flight Recorder, Inc.
Work:                  http://www.nfr.net
Personal:              http://pubweb.nfr.net/~mjr