Re: [SAde] ...

daniel, thx for offering help, but how to check the very 1st RECEIVED header
only??


Thx.
Lizz


> Lisa wrote:
>
> > Hi,
> >  I want to run a check on the Received From header but only the top most
one.
> >  The idea being to assign a penalty score if .dsl. shows as the top most
> >  Received header. I want to penalize certain strings that aren't going
> >  through their MX hosts. In other words, sending direct.
> >
> >  thx for any ideas
>
> I'm using this for example:
>
> # Normally I don't get mails from there
> # example: lsanca1-ar19-4-46-087-135.lsanca1.dsl-verizon.net
> header          DL_f_DSLVERIZON         Received =~ /dsl-verizon\.net/i
> describe        DL_f_DSLVERIZON         Received via DSL IP from Verizon
> score           DL_f_DSLVERIZON         0.6
>
> # example: midsouth-24-151-214-105.westtn.chartertn.net
> header          DL_f_SPEEDYAR           Received =~
/\[0-9]{1,3}\-[0-9]{1,3}\-[0-9]{1,3}\-[0-9]{1,3}\.speedy\.com\.ar/i
> describe        DL_f_SPEEDYAR           Received via dynamic ip client
from Speedy AR
> score           DL_f_SPEEDYAR           0.6
>
> header          DL_f_CLCOMCAST          Received =~
/client\.comcast\.net/i
> describe        DL_f_CLCOMCAST          Received via dynamic ip client
from Comcast
> score           DL_f_CLCOMCAST          0.6
>
> header          DL_f_OPTONLINE          Received =~ /dyn\.optonline\.net/i
> describe        DL_f_OPTONLINE          Received via dynamic ip client
from Optonline
> score           DL_f_OPTONLINE          0.6
>
> header          DL_f_DYNSUSPECT         Received =~
/[0-9]{1,3}\-[0-9]{1,3}\-[0-9]{1,3}\-[0-9]{1,3}\./i
> describe        DL_f_DYNSUSPECT         Received contains an ip like
100-100-100-100.domain
> score           DL_f_DYNSUSPECT         0.4
>
> You can try to modify this for your need.
>
> -- 
> Best Regards
> Daniel Luttermann
>
>
>
>
> -------------------------------------------------------
> This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo
> The Event For Linux Datacenter Solutions & Strategies in The Enterprise
> Linux in the Boardroom; in the Front Office; & in the Server Room
> http://www.enterpriselinuxforum.com





-------------------------------------------------------
This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo
The Event For Linux Datacenter Solutions & Strategies in The Enterprise 
Linux in the Boardroom; in the Front Office; & in the Server Room 
http://www.enterpriselinuxforum.com