crcsupport
asked on
Regular Expression question to filter with negation.
I'm trying to filter spams using regular expression.
I like to match any ip address except 192.168.100.200. I tried this using lookahead, but it doesn't work.
String to match:
"Received: from domain.com ([164.58.58.86]) by mail.domain.com" (any ip address, but not 192.168.100.200)
regex I tried, but didn't work;
:Received:\sfrom\sdomain\. com\s\(\[(?!(192\.168\.1\.20))\]\)\sby\smail\.domain\.co m"
What am I doing wrong?
I like to match any ip address except 192.168.100.200. I tried this using lookahead, but it doesn't work.
String to match:
"Received: from domain.com ([164.58.58.86]) by mail.domain.com" (any ip address, but not 192.168.100.200)
regex I tried, but didn't work;
:Received:\sfrom\sdomain\.
What am I doing wrong?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
At least I found the problem. It seems like regex engine stops and exits as soon as the lookahead processing is done. So the following characters are not analyzed.
Is this how it works?
For example, when I use "Received:\sfrom\sdomain\. com\s\(\[( ?!(192\.16 8\.1\.20)) " , It matches "Received: from domain.com ([164.58.58.86])",
but if I use the whole regex expression, it doesn't match
Is this how it works?
For example, when I use "Received:\sfrom\sdomain\.
but if I use the whole regex expression, it doesn't match
ASKER
Found another thing. I'm not sure why, but After lookahead, it always has to be followed by '.*'. So now the matching regex is the below and it works. I have no idea why this is.
Received:\sfrom\sdomain\.c om\s\(\[(? !(192\.168 \.1\.20))\ ]\).*by\smail\.domain\.com
Received:\sfrom\sdomain\.c
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Got you. I forgot it is just an assertion. I changed your expression to
Received:\sfrom\sdomain\.c om\s\(\[(? !(192\.168 \.1\.20))\ d+\.\d+\.\ d+\.\d+\]\ )\sby\smai l\.domain\ .com
It works too.
Thanks!
Received:\sfrom\sdomain\.c
It works too.
Thanks!
ASKER