The truncate section controls the parameters of the truncate feature. When a message source IP falls in the truncate range the IPs reputation is considered to be so bad that the message can be rejected or discarded without scanning its content.

<truncate on-off='on' probability='0.9' peek-one-in='5' symbol='20'/>

The on-off='on' attribute enables and on-off='off' disables this feature.

The probability='0.9' attribute estabishes the minimum truncate probability figure as 0.9. By default this value is 0.9 covering the worst half of the black range.

The peek-one-in='5' attribute establishes the peek (blindness paradox prevention) rate at one message in 5 by default. This means that by default every 5th message that would be truncated will be scanned by the content scanner as if the truncate feature were disabled. If the content scan fails to find a pattern match the message will still fail due to the source IP being in the black range, but the statistics for the IP will be adjusted to recognize the good hit. This allows sources that were in the truncate and black range to migrate into the normal range if they begin to consistently deliver good messages. Sources in the truncate range migrate more slowly-- but they don't have far to go before they are in the black range where they can migrate as quickly as they deliver good messages. Generally, only a few are required to get out of the default black range.

The symbol='20' attribute establishes the symbol associated with this region as 20. If GBUdb overrides the pattern scanner in SNF due to the source IP falling in this region then this is the symbolic code that will be returned.

Please email support@armresearch.com with any questions.