CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 941
Comments: 25
block bottom
spacer spacer

Wildcard Expressions vs. Regular Expressions
Goto page 1, 2  Next
 
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Walt

Sergeant
Sergeant


Joined: Mar 15, 2003
Posts: 91
Location: USA

PostPosted: Sat Nov 29, 2003 2:31 pm    Post subject: Wildcard Expressions vs. Regular Expressions
Reply with quote

I notice that within the Filter Sidebar, the Friends List and the Blacklist both use wildcard expressions but the Filters use regular expressions for text string pattern matching.

It would be sure nice if everything in the Filter Sidebar used the same form and format for string expressions. By this, I mean focus in onto the more powerful of the two, and go with simply Regular Expressions for everything.

Am I the only one who likes consistancy and would support such a suggestion?

Back to top
View users profile Send private message
AlphaCentauri

SIRT Handler
Premium Member

Joined: Nov 20, 2003
Posts: 2705

Premium

PostPosted: Sat Nov 29, 2003 8:56 pm    Post subject:
Reply with quote

I agree. It makes it harder to learn the more powerful expressions if they don't work are aren't the same for both.

Back to top
View users profile Send private message
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10612

Premium

PostPosted: Sat Nov 29, 2003 9:22 pm    Post subject:
Reply with quote

Probably overkill for the black and friends lists, a couple *'s are a lot easier to deal with than regex.

What type of expression could you add to the blacklist that you can't add as a filter?


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
Walt

Sergeant
Sergeant


Joined: Mar 15, 2003
Posts: 91
Location: USA

PostPosted: Sat Nov 29, 2003 9:39 pm    Post subject:
Reply with quote

Well, I was trying to be fancy, and write a single blacklist entry which will tag all foreign (to the USA) domains.

Some examples would be:
spamer@aol.com.mx
junk@hotmail.com.ru
porn@free.cm.fi


I could write a regular expression which will look for exactly two characters following a second dot after the at-sign. Can that be done with wildcards and be certain it would not trap something like mom@home.us ??

Also, now that I had to learn Regular Expressions, I want to use them. Wink

Back to top
View users profile Send private message
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10612

Premium

PostPosted: Sat Nov 29, 2003 10:22 pm    Post subject:
Reply with quote

Maybe *.?? would if you added *.us to the friends list but that would tag too many domains friendly.

Why don't you just use the filter function for this? Gary has one that looks to fit the bill, second form the end of the list and he has the country codes a bit farther down so you can customize it to fit your needs if you aren't a US resident.

http://www.w5hq.com/MailWasher/MailWasherFilters.txt

The blacklist has a place but complex filtering isn't what it was intended for.


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16509

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sun Nov 30, 2003 7:59 am    Post subject:
Reply with quote

Walt wrote:
Well, I was trying to be fancy, and write a single blacklist entry which will tag all foreign (to the USA) domains.

You .. you .... ISOLATIONIST! Surprised

Walt wrote:
I could write a regular expression which will look for exactly two characters following a second dot after the at-sign. Can that be done with wildcards and be certain it would not trap something like mom@home.us ??

Yeah. And exactly how does one filter out Texans? Razz

Walt wrote:
Also, now that I had to learn Regular Expressions, I want to use them. Wink

Sure. Show them how it's done then they turn around and use it against you! Rolling Eyes

Back to top
View users profile Send private message
Perry

Lieutenant
Lieutenant


Joined: Oct 19, 2003
Posts: 291
Location: USA

PostPosted: Sun Nov 30, 2003 8:07 am    Post subject:
Reply with quote

Ikeb wrote:

Yeah. And exactly how does one filter out Texans? Razz



I'm thinking that you may be able to come close based on address. The question is how do you filter them out of your state or out of the White House?

Perry

Back to top
View users profile Send private message Visit posters website
denn988

Guest
IP: 66.44.*.*






PostPosted: Tue Dec 02, 2003 3:25 am    Post subject:
Reply with quote

Ikeb wrote:

Yeah. And exactly how does one filter out Texans?


You use the same filter that you would use to filter out Canadians....but you just hold it lower....

As far as filtering out foreign addresses, here is one that filters out most e-mail that originated from foreign sources. This is not based on sender address, but originating IP address.

This filter looks for any IP address in the 'Received:" lines in the header that is associated with Europe (RIPE), Asia-Pacific (APNIC), and Latin America (LACNIC).

Code:

[enabled],FOREIGN,FOREIGN,16711808,AND,Delete,EntireHeader,containsRE,"(?#   list of IP blocks assigned to RIPE - must be updated as required   )^Received: from [^[]*?\[(62|8[0-4]|19[345]|21[237])(\.[1-2]?\d?\d?){3}\]",EntireHeader,containsRE,"(?#   list of IP blocks assigned to APNIC - must be updated as required   )^Received: from [^[]*?\[(6[01]|20[23]|21[01]|21[89]|22[0-2])(\.[1-2]?\d?\d?){3}\]",EntireHeader,containsRE,"(?#   list of IP blocks assigned to LACNIC - must be updated as required   )^Received: from [^[]*?\[20[01](\.[1-2]?\d?\d?){3}\]"


Note:

The above filter has been updated to be current as of this month. To check for future updates as required, see the following IANA link.


Also...

IANA RESERVED should be updated as follows:

Code:

[enabled],"IANA RESERVED [AD]","IANA RESERVED [AD]",180,AND,Delete,TakesPrecedence,Automatic,EntireHeader,containsRE,"(?#   list of IP blocks reserved by IANA -  must be updated as required   )^Received: from [^[]*?\[([1257]|2[37]|3[1679]|4[129]|5[089]|7\d|8[5-9]|9\d|1[01]\d|12[0-6]|17[3-9]|18[0-79]|19[07]|22[3-9]|2[34]\d|25[0-5])(\.[1-2]?\d?\d?){3}\][^;:]*?"



NOTES:

This change reflects the assignment of blocks 83 and 84 to RIPE. They had previously been IANA RESERVED.

This version of IANA RESERVED is set to AUTO-DELETE. While I have no problems using AUTO-DELETE for anything that contains obviously forged 'Received:' lines in the header, someone else might not want to do that. If you do not wish to AUTO-DELETE you will have to change that function in the filter after installing.

Back to top
IP: 68.51.*.*

Guest






PostPosted: Tue Dec 02, 2003 4:05 am    Post subject:
Reply with quote

Thanks for that denn988 my experience with the internet hasn't expanded to where I understand the workings of (RIPE), (APNIC), (LACNIC) but your posting makes me want to look into it. I know there are other threads on the subject. As it is now I would be held prisoner until someone else updated the filters for me.

It would be cool if there were just a forum for MailWasher Filter threads and that way every past posting could be in one area under one roof. Not to be done I know but it would help.

Perry wrote:

The question is how do you filter them out of your state or out of the White House?


I was very happy with my vote in 2000. Better than the Tennessee alternative. Thank you very much.

Back to top
IP: 68.51.*.*

Guest






PostPosted: Tue Dec 02, 2003 4:38 am    Post subject:
Reply with quote

Anonymous wrote:

It would be cool if there were just a forum for MailWasher Filter threads and that way every past posting could be in one area under one roof.


Of course if I put "filter" in the search box and zero in on the MailWasher forums there they are; all post under one roof. Thumbs Up

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16509

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Tue Dec 02, 2003 6:56 am    Post subject:
Reply with quote

denn988 wrote:
Ikeb wrote:

Yeah. And exactly how does one filter out Texans?


You use the same filter that you would use to filter out Canadians....but you just hold it lower....

Rolling on the floor laughing... Actually it would have to be held higher. Wink

denn988 wrote:
As far as filtering out foreign addresses, here is one that filters out most e-mail that originated from foreign sources. This is not based on sender address, but originating IP address.

This filter looks for any IP address in the 'Received:" lines in the header that is associated with Europe (RIPE), Asia-Pacific (APNIC), and Latin America (LACNIC).

Code:

[enabled],FOREIGN,FOREIGN,16711808,AND,Delete,EntireHeader,containsRE,"(?#   list of IP blocks assigned to RIPE - must be updated as required   )^Received: from [^[]*?\[(62|8[0-4]|19[345]|21[237])(\.[1-2]?\d?\d?){3}\]",EntireHeader,containsRE,"(?#   list of IP blocks assigned to APNIC - must be updated as required   )^Received: from [^[]*?\[(6[01]|20[23]|21[01]|21[89]|22[0-2])(\.[1-2]?\d?\d?){3}\]",EntireHeader,containsRE,"(?#   list of IP blocks assigned to LACNIC - must be updated as required   )^Received: from [^[]*?\[20[01](\.[1-2]?\d?\d?){3}\]"


You might want to consider adding another rule:
Code:
EntireHeader,doesn'tContain,"(?# excludes newsletters from FireStorm) Received: from sunshine.element5.com (217.65.128.203)"

Wink

Back to top
View users profile Send private message
Perry

Lieutenant
Lieutenant


Joined: Oct 19, 2003
Posts: 291
Location: USA

PostPosted: Tue Dec 02, 2003 8:39 am    Post subject:
Reply with quote

Anonymous wrote:
Thanks for that denn988 my experience with the internet hasn't expanded to where I understand the workings of (RIPE), (APNIC), (LACNIC) but your posting makes me want to look into it. I know there are other threads on the subject. As it is now I would be held prisoner until someone else updated the filters for me.

It would be cool if there were just a forum for MailWasher Filter threads and that way every past posting could be in one area under one roof. Not to be done I know but it would help.

Perry wrote:

The question is how do you filter them out of your state or out of the White House?


I was very happy with my vote in 2000. Better than the Tennessee alternative. Thank you very much.


By a negative million.

Perry

Back to top
View users profile Send private message Visit posters website
IP: 192.19.*.*

Guest






PostPosted: Tue Dec 02, 2003 12:59 pm    Post subject:
Reply with quote

denn988 wrote:

Code:

[enabled],FOREIGN,FOREIGN,16711808,AND,Delete,EntireHeader,containsRE,"(?#   list of IP blocks assigned to RIPE - must be updated as required   )^Received: from [^[]*?\[(62|8[0-4]|19[345]|21[237])(\.[1-2]?\d?\d?){3}\]",EntireHeader,containsRE,"(?#   list of IP blocks assigned to APNIC - must be updated as required   )^Received: from [^[]*?\[(6[01]|20[23]|21[01]|21[89]|22[0-2])(\.[1-2]?\d?\d?){3}\]",EntireHeader,containsRE,"(?#   list of IP blocks assigned to LACNIC - must be updated as required   )^Received: from [^[]*?\[20[01](\.[1-2]?\d?\d?){3}\]"




Could someone please "translate" this into what I need to enter into the menu provided by MW Pro for filters? I mean, I am unsure what tokens like "FOREIGN, FOREIGN", "16711808" , "AND" are intended to be.

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16509

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Tue Dec 02, 2003 1:38 pm    Post subject:
Reply with quote

Just close MWP, add this to filters.txt, save the file, and reopen MWP.

Back to top
View users profile Send private message
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10612

Premium

PostPosted: Tue Dec 02, 2003 5:29 pm    Post subject:
Reply with quote

I can't begin to translate it but if you browse or search the filter threads you will find links to websites that might help if you do want to understand.


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions All times are GMT
Goto page 1, 2  Next
Page 1 of 2

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer