Cisco Cisco Email Security Appliance C170 사용자 가이드

Unless otherwise noted, regular expressions are case-sensitive. Thus, if your regular expression is 
searching for 

foo

, it does not match the pattern 

FOO

 or even 

Foo

.

This example shows two filters that do the same thing, but the first one takes much more CPU. The 
second filter uses a regular expression that is more efficient.

In this instance, AsyncOS will have to start the regular expression engine 30 times, once for each 
attachment type and the recv-listener.

Instead, write the filter to look like this:

rcpt-to != "^goober@dev\\.null\\....$" (non-matching)

attachment-filter: if ((recv-listener == "Inbound") AND 

((((((((((((((((((((((((((((((((((((((((((((((attachment-filename ==

"\\.386$") OR (attachment-filename == "\\.exe$")) OR (attachment-filename == "\\.ad$")) 

OR (attachment-filename == "\\.ade$")) OR (attachment-filename == "\\.adp$")) OR 

(attachment-filename == "\\.asp$")) OR (attachment-filename == "\\.bas$")) OR 

(attachment-filename == "\\.bat$")) OR (attachment-filename == "\\.chm$")) OR 

(attachment-filename == "\\.cmd$")) OR (attachment-filename == "\\.com$")) OR 

(attachment-filename == "\\.cpl$")) OR (attachment-filename == "\\.crt$")) OR 

(attachment-filename == "\\.exe$")) OR (attachment-filename == "\\.hlp$")) OR 

(attachment-filename == "\\.hta$")) OR (attachment-filename == "\\.inf$")) OR 

(attachment-filename == "\\.ins$")) OR (attachment- filename == "\\.isp$")) OR 

(attachment-filename == "\\.js$")) OR (attachment-filename == "\\.jse$")) OR 

(attachment- filename == "\\.lnk$")) OR (attachment-filename == "\\.mdb$")) OR 

(attachment-filename == "\\.mde$")) OR (attachment-filename == "\\.msc$")) OR 

(attachment-filename == "\\.msi$")) OR (attachment-filename == "\\.msp$")) OR 

(attachment-filename == "\\.mst$")) OR (attachment-filename == "\\.pcd$")) OR 

(attachment-filename == "\\.pif$")) OR (attachment-filename == "\\.reg$")) OR 

(attachment-filename == "\\.scr$")) OR (attachment-filename == "\\.sct$")) OR 

(attachment-filename == "\\.shb$")) OR (attachment-filename == "\\.shs$")) OR 

(attachment-filename == "\\.url$")) OR (attachment-filename == "\\.vb$")) OR 

(attachment-filename == "\\.vbe$")) OR (attachment-filename == "\\.vbs$")) OR 

(attachment-filename == "\\.vss$")) OR (attachment-filename == "\\.vst$")) OR 

(attachment-filename == "\\.vsw$")) OR (attachment-filename == "\\.ws$")) OR 

(attachment-filename == "\\.wsc$")) OR (attachment-filename == "\\.wsf$")) OR 

(attachment-filename == "\\.wsh$"))) { bounce(); }

attachment-filter: if (recv-listener == "Inbound") AND (attachment-filename == 

"\\.(386|exe|ad|ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|js|jse|l

nk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shb|shs|url|vb|vbe|vbs|vss|vst|vsw|ws|wsc

|wsf|wsh)$") {

    bounce();

  }