Custom Filters...I need to filter on any 6 number strings

Unanswered Question
Oct 20th, 2008
User Badges:

Can anyone out there let me know how to set a filter for this?
Would "\#?" work? It seems like I need to put in a parameter for 6, but I am not sure how.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
kluu_ironport Tue, 10/21/2008 - 00:15
User Badges:

\d is for any digit
\b is a word boundary

Try this:


The above will match 6 numbers in a roll, even if wedged between letters (i.e. test123456test )



The above will match the same thing but be stricter in that the character to the left and the right cannot be a special character or letter I believe. Test both and see what you're more comfortable with.

Jason Meyer Tue, 10/21/2008 - 14:45
User Badges:

Not trying to hijack this thread but was wondering if there are any good books on writing these custom message filters. I understand it is based on Python but that's about it... any good guides?

kluu_ironport Tue, 10/21/2008 - 15:10
User Badges:

Funny you should ask. Here's a good starting point. One of our sales engineer compiled this Support Portal knowledge base article together. There are links to Python regex guides and examples of how to test.

How do I test regular expressions before using them in a filter?

How do I test regular expressions before using them in a filter?

The regular expressions in IronPort filters are Python regular expressions. There is a Python regular expression debugging tool at In addition to the AsyncOS User Guide (see below), you can use some of the following Internet resources to help understand the syntax of regular expressions in IronPort filters:

For Windows users, there is another product to test regular expressions:

The Trace command can also be useful in testing regular expressions. However, the Trace command (in both the GUI and CLI) works only on committed changes. This means that you must have your regular expression "in production" to use Trace. You can write a filter that has only the regular expression and no actions if you want to test the regular expression using Trace without fully committing your message filter or content filter to production operation.

You can also use a system quarantine to test regular expressions in filter rules. For more information, refer to Answer ID 87: How do I test and debug a message filter or a content filter before I put it into production?" title="Answer ID 87.

For more information about message filter rules, see the AsyncOS Advanced User Guide on the IronPort Support Portal[].


This Discussion