From: José Luis Tallón (jltallonadv-solutions.net)
Date: Sat Apr 17 2004 - 14:40:44 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

At 17:01 17/04/2004, you wrote:
>WC -Sx- Jones wrote:
>>Tony Earnshaw wrote:
>>
>>>/(?:^Received:\s{1,2}from\s+.+213\.37\.(?:(?:(?:1(?:[5-9][0-9])|(?:2(?:0|1|2|3|4)[0-9])|(?:25[0-1]))))\.\d{1,3})/
>>>
>
>>Something like:
>>/\[213\.37\.[150-251]\.[0-255]\]/
>
>
>OK, after thinking some more about this; I feel that
>
>/213\.37\.(?:(?:(?:1(?:[5-9][0-9])|(?:2(?:0|1|2|3|4)[0-9])|(?:25[0-1]))))\.\d{1,3}/
>
>is as short as required - logically if you see the banned IP in the
>HEADERS -- then the whole e-mail is suspect, no?
>
>If so, this can literally be written as:
>
>/213\.37\.[150-251]\.[0-255]/ or
>/213\.37\.(?:[150-251])\.(?:[0-255])/ or
>/213\.37\.(?:150...251)\.(?:0...255)/
>
>But while they are syntactically correct -- none work :(

Of course, they are not *semantically correct*.
The regexp "/213\.37\.[150-251]\.[0-255]/" means "'213.37.' followed by
1,5, one char between 0 and 2, 5 or 1 '.' one char between 0 and 2, 5 or 5"
Regexp does not understand Maths: [0-2] means "one char from 0 to 2,
inclusive"; Hence, [0-255] means "one char from 0 to 2, inclusive, or a 5
or a 5", instead of what you thought it meant.
Postmap is you friend :)

Best,
         J.L.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]