OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: "Potted" regexquestion

From: WC -Sx- Jones (WC-Sx-Jonesinsecurity.org)
Date: Sat Apr 17 2004 - 15:03:40 CDT


José Luis Tallón wrote:
> At 17:01 17/04/2004, you wrote:
>
>> WC -Sx- Jones wrote:

>> /213\.37\.[150-251]\.[0-255]/ or
>> /213\.37\.(?:[150-251])\.(?:[0-255])/ or
>> /213\.37\.(?:150...251)\.(?:0...255)/
>>
>> But while they are syntactically correct -- none work :(
>
>
> Of course, they are not *semantically correct*.

:) I was using pcretest. Yes, I figured out it would never match what
I expected.

What I sort of settled on so far:

/213\.37\.(?:1[5-9][0-9]|2(?:[1-4][0-9]|5[0-1]))\.\d{1,3}/

Not sure what Tony will do. The RegEx originally posted was long but
worked correctly and consistently -- the question as posted was did
anyone know of a site that had done this work for most spam sites
already. I was just trying to see if there was any way to shorten the
amount of work needed for "like" RegEx's in the future.

If I look at the "million monkeys" rule I believe all sites will
eventually be blocked by all MTAs and e-mail spam will be solved once
and for all :)

_Sx_ http://youve-reached-the.endoftheinternet.org/ _____
      http://jaxpm.insecurity.org/
      http://cis4dl.insecurity.org/