Cisco Cisco Email Security Appliance C160 Mode D'Emploi

This example shows two filters that do the same thing, but the first one takes much 
more CPU. The second filter uses a regular expression that is more efficient.

In this instance, AsyncOS will have to start the regular expression engine 30 
times, once for each attachment type and the recv-listener.

attachment-filter: if ((recv-listener == "Inbound") AND 

((((((((((((((((((((((((((((((((((((((((((((((attachment-filename ==

"\\.386$") OR (attachment-filename == "\\.exe$")) OR 

(attachment-filename == "\\.ad$")) OR (attachment-filename == 

"\\.ade$")) OR (attachment-filename == "\\.adp$")) OR 

(attachment-filename == "\\.asp$")) OR (attachment-filename == 

"\\.bas$")) OR (attachment-filename == "\\.bat$")) OR 

(attachment-filename == "\\.chm$")) OR (attachment-filename == 

"\\.cmd$")) OR (attachment-filename == "\\.com$")) OR 

(attachment-filename == "\\.cpl$")) OR (attachment-filename == 

"\\.crt$")) OR (attachment-filename == "\\.exe$")) OR 

(attachment-filename == "\\.hlp$")) OR (attachment-filename == 

"\\.hta$")) OR (attachment-filename == "\\.inf$")) OR 

(attachment-filename == "\\.ins$")) OR (attachment- filename == 

"\\.isp$")) OR (attachment-filename == "\\.js$")) OR 

(attachment-filename == "\\.jse$")) OR (attachment- filename == 

"\\.lnk$")) OR (attachment-filename == "\\.mdb$")) OR 

(attachment-filename == "\\.mde$")) OR (attachment-filename == 

"\\.msc$")) OR (attachment-filename == "\\.msi$")) OR 

(attachment-filename == "\\.msp$")) OR (attachment-filename == 

"\\.mst$")) OR (attachment-filename == "\\.pcd$")) OR 

(attachment-filename == "\\.pif$")) OR (attachment-filename == 

"\\.reg$")) OR (attachment-filename == "\\.scr$")) OR 

(attachment-filename == "\\.sct$")) OR (attachment-filename == 

"\\.shb$")) OR (attachment-filename == "\\.shs$")) OR 

(attachment-filename == "\\.url$")) OR (attachment-filename == 

"\\.vb$")) OR (attachment-filename == "\\.vbe$")) OR 

(attachment-filename == "\\.vbs$")) OR (attachment-filename == 

"\\.vss$")) OR (attachment-filename == "\\.vst$")) OR 

(attachment-filename == "\\.vsw$")) OR (attachment-filename == 

"\\.ws$")) OR (attachment-filename == "\\.wsc$")) OR 

(attachment-filename == "\\.wsf$")) OR (attachment-filename == 

"\\.wsh$"))) { bounce(); }