Link to home
Start Free TrialLog in
Avatar of crcsupport
crcsupportFlag for United States of America

asked on

Regular Expression question to filter with negation.

I'm trying to filter spams using regular expression.
I like to match any ip address except 192.168.100.200. I tried this using lookahead, but it doesn't work.

String to match:
"Received: from domain.com ([164.58.58.86]) by mail.domain.com"  (any ip address, but not 192.168.100.200)

regex I tried, but didn't work;
:Received:\sfrom\sdomain\.com\s\(\[(?!(192\.168\.1\.20))\]\)\sby\smail\.domain\.com"

What am I doing wrong?
SOLUTION
Avatar of Frank Helk
Frank Helk
Flag of Germany image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of crcsupport

ASKER

Thanks frankhelk
At least I found the problem. It seems like regex engine stops and exits as soon as the lookahead processing is done. So the following characters are not analyzed.
Is this how it works?

For example, when I use "Received:\sfrom\sdomain\.com\s\(\[(?!(192\.168\.1\.20))" , It matches "Received: from domain.com ([164.58.58.86])",
but if I use the whole regex expression, it doesn't match
Found another thing. I'm not sure why, but After lookahead, it always has to be followed by '.*'. So now the matching regex is the below and it works. I have no idea why this is.

Received:\sfrom\sdomain\.com\s\(\[(?!(192\.168\.1\.20))\]\).*by\smail\.domain\.com
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Got you. I forgot it is just an assertion. I changed your expression to
Received:\sfrom\sdomain\.com\s\(\[(?!(192\.168\.1\.20))\d+\.\d+\.\d+\.\d+\]\)\sby\smail\.domain\.com

It works too.

Thanks!