Cisco Cisco Email Security Appliance C680 User Guide

Body size refers to the size of the message, including both headers and attachments. The 

body-size

 rule 

selects those messages where the body size compares as directed to a given number. For example, the 
following filter bounces any message where the body size is greater than 5 megabytes.

The 

body-size

 can be compared in the following ways:

As a convenience, the size measurement may be specified with a suffix:

The 

remote-ip 

rule tests to see if the IP address of the host that sent that message matches a certain 

pattern. The IP address can be either Internet Protocol version 4 (IPv4) or Internet Protocol version 6 
(IPv6). The IP address pattern is specified using the allowed hosts notation described in “Sender Group 
Syntax” in the Cisco IronPort AsyncOS for Email Configuration Guide, except for the 

SBO

, 

SBRS

, 

dnslist

 notations and the special keyword 

ALL

. 

BigFilter:

   if (body-size > 5M)

   {

        bounce();

   }

body-size < 10M

Less than

body-size <= 10M

Less than or equal

body-size > 10M

Greater than

body-size >= 10M

Greater than or equal

body-size == 10M

Equal

body-size != 10M

Not equal

10b

ten bytes (same as 10)

13k

thirteen kilobytes

5M

five megabytes

40G

40 gigabytes (Note: The Cisco IronPort appliance cannot accept messages larger than 
100 megabytes.)