Re: RCVD_VIA_APNIC: CIDR to regex generator?

2009-10-02 Thread Steven W. Orr
On 10/02/09 02:43, quoth Warren Togami:
> # 2005/07/29, http://www.apnic.net/db/ranges.html header   RCVD_VIA_APNIC
> Received =~ 
> /[^0-9.](?:5[89]|6[01]|12[456]|20[23]|21[0189]|22[012])(?:\.[012]?[0-9]{1,2}){3}(?:\]|\)|
>  )/ describe RCVD_VIA_APNIC Received through a relay in Asia/Pacific
> Network
> 
> Adam Katz had this rule in one of his channels.  While it is wholly unsafe
> to be used alone, it could be useful in masscheck statistics and possibly
> if used in meta booleans in combination with other rules.
> 
> http://www.apnic.net/publications/research-and-insights/ip-address-trends/apnic-resource-range
> 
> 
> Unfortunately, in testing the above rule on my own corpus I see it is 
> missing some obvious Asian addresses.  This page reveals that the regex is
> out of date.  Does there exist a good automated way to convert many CIDR
> ranges to a single regex?
> 
> Warren Togami wtog...@redhat.com

http://www.brandonhutchinson.com/CIDR_netmasks_with_sendmail.html

-- 
Time flies like the wind. Fruit flies like a banana. Stranger things have  .0.
happened but none stranger than this. Does your driver's license say Organ ..0
Donor?Black holes are where God divided by zero. Listen to me! We are all- 000
individuals! What if this weren't a hypothetical question?
steveo at syslang.net



signature.asc
Description: OpenPGP digital signature


RCVD_VIA_APNIC: CIDR to regex generator?

2009-10-01 Thread Warren Togami

# 2005/07/29, http://www.apnic.net/db/ranges.html
header   RCVD_VIA_APNIC Received =~ 
/[^0-9.](?:5[89]|6[01]|12[456]|20[23]|21[0189]|22[012])(?:\.[012]?[0-9]{1,2}){3}(?:\]|\)| 
)/

describe RCVD_VIA_APNIC Received through a relay in Asia/Pacific Network

Adam Katz had this rule in one of his channels.  While it is wholly 
unsafe to be used alone, it could be useful in masscheck statistics and 
possibly if used in meta booleans in combination with other rules.


http://www.apnic.net/publications/research-and-insights/ip-address-trends/apnic-resource-range
Unfortunately, in testing the above rule on my own corpus I see it is 
missing some obvious Asian addresses.  This page reveals that the regex 
is out of date.  Does there exist a good automated way to convert many 
CIDR ranges to a single regex?


Warren Togami
wtog...@redhat.com