Message Sniffer works by locating tell-tale patterns in the messages it scans. These patterns are defined by heuristic rules. These rules are organized into groups which help us to identify kinds of spam and the procedures we used to generate those rules. Each of these rule groups is given a symbol - which is a number. When the scanner finds a pattern in a message it returns the symbol representing the rule group associated with that pattern.