You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

SNFClient_readme.txt 6.2KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182
  1. SNFClient Readme
  2. Command line client for SNF. This utility formats and processes SNF_XCI
  3. requests through the SNF Engine working on the local machine. In general
  4. this utility can be used as a replacement for the earlier SNF command
  5. line scanner. It is also useful for other uses such as debugging and
  6. communicating with GBUdb.
  7. Note: Unlike prior versions of SNF, this command line utility does not
  8. need to be "branded" (renamed for the SNF license id).
  9. _________
  10. Help Mode
  11. SNFClient.exe
  12. When called with no command line parameters the utility produces
  13. help and version information.
  14. __________
  15. Debug Mode
  16. SNFDebugClient.exe
  17. When "debug" or "Debug" appears in the path to the program name
  18. or if the program's name is altered to include the word "debug" or
  19. "Debug" then the program will produce additional information about
  20. it's operation to aid in debugging problems. This includes the
  21. entire raw SNF_XCI request and response.
  22. __________________
  23. Message Scan Modes
  24. These modes are used to scan email message files (the data part of
  25. smtp). This utility can be used as a drop-in replacement for previous
  26. verions of SNF (Message Sniffer) for scanning messages. However, this
  27. new version does not need to be "branded" (renamed for the license id)
  28. and will ignore the authentication string if it is provided. Also,
  29. since the newer version of SNF uses a client-server model and not a
  30. peer-server model, there is no need for a "persistent" mode.
  31. If "persistent" is passed to this utility on the command line as it
  32. would be used in prior versions of SNF then it will be treated like
  33. a file name and the scan will normally fail since a file named
  34. "persistent" is not likely to exist.
  35. SNFClient.exe <FileNameToScan>
  36. Scan Mode: Scans <FileNameToScan> and returns a result code.
  37. SNFClient.exe <authenticationxx> <FileNameToScan>
  38. Compatibility Mode: Ignores <authenticationxx> then scans the
  39. <FileNameToScan> and returns a result code. This mode provides
  40. drop-in compatibility with previous versions of SNF.
  41. SNFClient.exe -xhdr <FileNameToScan>
  42. XHeader Mode: Scans <FileNameToScan> and returns the result. Also
  43. outputs the contents of the X-Headers created by the SNF engine. If
  44. the SNF engine is configured to inject these headers then they will
  45. also have been injected into the <FileNameToScan>.
  46. The SNF Engine can be configured to provide the X-Headers only to
  47. the API without injecting them. In this case the XHeader Mode will
  48. display the X-Headers that would be injected, but they will not
  49. have been injected into the <FileNameToScan>.
  50. If the SNF Engine is configured not to produce X-Headers (none) then
  51. the XHeader Mode will not produce X-Headers because they will not
  52. have been generated by the engine.
  53. (note: -xhdr and -source options can be combined)
  54. SNFClient.exe -source=<IP4Address> <FileNameToScan>
  55. Source-IP Mode: Scans <FileNameToScan> and returns the result. The
  56. provided source IP is injected into the scan as the first Received
  57. header so that the scanning engine will presume the IP is the source
  58. of the message. This allows you to pre-define the source IP for the
  59. message when there is no other received header or when the received
  60. headers may be incorrect or may not present the actual source of
  61. the message.
  62. (note: -xhdr and -source options can be combined)
  63. _____________________________
  64. SNFServer Status Report Modes
  65. SNFClient.exe -status.second
  66. SNFClient.exe -status.minute
  67. SNFClient.exe -status.hour
  68. This mode returns the latest posted status report as indicated.
  69. Normally these status reports are also posted to files in the
  70. SNFServer workspace.
  71. In this mode the SNFClient will return a result code (error level)
  72. of 0 when the request is successful and 99 (or some nonzero value)
  73. when the request is not successful. This allows the SNFClient to
  74. be used to verify that the SNFServer is running.
  75. Note: In most other modes the SNFClient returns a fail-safe 0
  76. result code to avoid tagging messages as spam when there are errors.
  77. ________________________
  78. XCI Server Command Modes
  79. These features will expand as needed in later versions.
  80. SNFClient.exe -shutdown
  81. If the SNF Engine is running in an application that accepts SNF_XCI
  82. server commands then this mode will send that command. The shutdown
  83. command may have no effect if the application does not use the SNF_XCI
  84. server commnand interface or does not recognize the command.
  85. ___________
  86. GBUdb Modes
  87. These modes are used to communicate with the GBUdb system on the
  88. local node. It is possible to test (read out) an IP record or make
  89. any of a number of changes to IP data in the GBUdb.
  90. SNFClient.exe -test <IP4Address>
  91. Returns the current GBUdb statistics for the <IP4Address>
  92. SNFClient also returns a result code that matches the GBUdb range
  93. for the tested IP. These ranges are defined in the SNFServer
  94. configuration file. By default they are:
  95. 20 - Truncate
  96. 63 - Black
  97. 40 - Caution
  98. 0 - Normal
  99. SNFClient.exe -set <IP4Address> <flag> <bad> <good>
  100. Creates or updates the data for <IP4Address> as provided. The
  101. <IP4Address> must be provided as well as at least one of
  102. <flag>, <bad>, and <good>. If <flag>, <bad>, or <good> are
  103. to be left unchanged then they should be entered as a dash "-".
  104. Examples:
  105. Set all data for an IP. The flag will be "ugly", the bad count
  106. will be 0 and the good count will be 1000.
  107. SNFClient.exe -set 12.34.56.78 Ugly 0 1000
  108. Set the flag to "ignore" and do not change the counts.
  109. SNFClient.exe -set 12.34.56.78 ignore - -
  110. Set the good count to 400 and do not change anything else.
  111. SNFClient.exe -set 12.34.56.78 - - 400
  112. SNFClient.exe -good <IP4Address>
  113. Creates or updates statistics for the <IP4Address>. Increases the
  114. good count by one. (Record a good event)
  115. SNFClient.exe -bad <IP4Address>
  116. Creates or updates statistics for the <IP4Address>. Increases the
  117. bad count by one. (Record a bad event)
  118. SNFClient.exe -drop <IP4Address>
  119. Removes all local data for the <IP4Address>. Anything the local
  120. system "knows" about the IP is forgotten. Next time the IP is
  121. encountered it will be treated as new.
  122. ____________________
  123. For More Information
  124. See www.armresearch.com
  125. Copyright (C) 2007-2008 Arm Research Labs, LLC.