/spamfilter add u gzline 1h Channel_Flooder ![a-z][0-9]{4}@[^:]+:[a-z]{9}
So somehow they got pass the filter. Am I missing something?
Also, how can I check that this filter will work against entries in my logs? Yes, I'm in the process of RTFM.
Stealth wrote:Note the addition of ~? and the change of {4} to {2,4}. These are very crucial parts of the spamfilter if you wish to catch all these clones.
As Homer would say: "DOH!" Something told me that I needed something for the lack of IDENT. I was also wondering why, when testing RegEx expressions in BareGrep, that the {4} portion was working, but not catching the [a-z]. I kept trying [a-z]{2} [0-9]{4} and varients of that with no success. Now it all makes sense.
Super thanx for that. Darn these RegEx rules can be a tough nut to crack.
No. The numbers between {} mean "least, most" occurrences. For example, the [0-9]{2,4} means a single digit occurring at least twice, but no more than 4 times. Because this is only the ident we care about (in this particular section), there are no clones with fewer than 2 numbers, and no more than 4 numbers in their ident.
Stealth wrote:No. The numbers between {} mean "least, most" occurrences. For example, the [0-9]{2,4} means a single digit occurring at least twice, but no more than 4 times. Because this is only the ident we care about (in this particular section), there are no clones with fewer than 2 numbers, and no more than 4 numbers in their ident.
Ah. OK. I was thinking it had to do with the number of chars. 1,4 meaning 1 letter and 4 numbers, but I see that now. I read about {} from http://www.regular-expressions.info/reference.html, but couldn't quite get my head wrapped around it.