MCP score counting everything twice in HTML emails

Dave Jones davejones70 at gmail.com
Fri Oct 26 13:39:14 IST 2007


I am using the SA rule keyword "tflags [SOME_RULE_NAME] multiple" to get SA
to count multiple occurrences of the same word.  An interesting side effect
is that emails with HTML count everything twice so if there is really only 1
instance of a word, we get 2 hits -- one for the plain text part of the
email and one for the HTML part of the email.

Is there any way to only scan the HTML portion if it exists then fallback to
the text only if it is not an HTML email?  We really need to accurately
score multiple words without getting double scored.

-- 
Dave Jones
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20071026/73eaa445/attachment.html


More information about the MailScanner mailing list