Thanks John, I had tried this. It appears that the \1 is not defined within the pattern. Only for substitution?
mike On 11/2/07, John D. Hardin <[EMAIL PROTECTED]> wrote: > > On Fri, 2 Nov 2007, Mike Kenny wrote: > > > I have a number of users that are receiving spam of varying types. The > only > > common factor is the from address. This looks like > > > > from=<[EMAIL PROTECTED]> > > > > where sX.com looks like it is a genuine site name, e.g. > > shibatec.com > > southstreetfinancial.com > > skiprockmultimedia.com > > > > etc. > > > > What I need (I think) is a perl regex that will match the above > > patter. This is beyond my experience, can anybody assist me? > > Backreferences. > > Try this - I haven't had a chance to test it yet: > > header XX From =~ /<dw(\S+)[EMAIL PROTECTED]>/ > > -- > John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > ----------------------------------------------------------------------- > "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never > does quite what I want. I wish Christopher Robin was here." > -- Peter da Silva in a.s.r > ----------------------------------------------------------------------- > 2 days until Daylight Saving Time ends in U.S. - Fall Back > >
