Attachment size rule?

[Pat Traynor <pa...@ssih.com>]

Does anyone know how I could write a rule based on an attachment size?
I'm getting a lot of spams with this specific file attached.  It's
always named differently, the the size is exactly the same each time.

--pat--
-- 
Pat Traynor
pat@ssih.com

Re: Attachment size rule?

[Theo Van Dinter <fe...@kluge.net>]

On Wed, Dec 15, 2004 at 11:40:43AM -0500, Matt Kettler wrote:
> Not easily. You could probably write a plugin to do it, but most of the SA 
> code tries fairly hard to remove attachments from the message before 
> feeding it to the rules.

A plugin could do it rather trivially.  There's no way using the normal rules
to do it, even if attachments were included for the non-full rules.

-- 
Randomly Generated Tagline:
"All cast members of the 7th Guest stayed at the luxurious Bates Motel 
 where 'Showering is Always an Adventure'."      - From the 7th Guest

Re: Attachment size rule?

[Matt Kettler <mk...@evi-inc.com>]

At 09:33 AM 12/15/2004, Pat Traynor wrote:
>Does anyone know how I could write a rule based on an attachment size?
>I'm getting a lot of spams with this specific file attached.  It's
>always named differently, the the size is exactly the same each time.

Not easily. You could probably write a plugin to do it, but most of the SA 
code tries fairly hard to remove attachments from the message before 
feeding it to the rules.

This might be a better job for mimedefang, mailscanner, or similar.

Razor might also be effective, as e4 does treat each mime part as a 
separate element, and can identify the recurring attachment as spam. Since 
SA supports Razor already, this would be pretty easy to add... 

Re: Attachment size rule?

[Rakesh <ra...@netcore.co.in>]

Pat Traynor wrote:

>Does anyone know how I could write a rule based on an attachment size?
>I'm getting a lot of spams with this specific file attached.  It's
>always named differently, the the size is exactly the same each time.
>
>--pat--
>  
>
What kind of contents are there in the attachment ? Are they mails 
related to kazakhistan and other countries economy ?

Rakesh