Better nfilter

Greetings,
I have worked on my nfilter with varying degress of success but stuff still gets through. Does nfilter really have case sensivity? What I have today, I have included below. If anyone has a better one, please post it.
Thank you, Bill Thomas
# # NewsProxy sample filter file # ===========================# # This is a sample filter file with comments. # # Note that lines that begin with a # are ignored. # # $Workfile: newsproxy.ini $ # $Archive: /NewsProxy/newsproxy.ini $ # $Date: 11/03/99 13:26 $ # $Revision: 1 $ # $Author: Mark Burkley $ # $Log: /NewsProxy/newsproxy.ini $ # # 1 11/03/99 13:26 Mark Burkley # Initial version # # ===========================# # Flag any posts in alt.animals.foo which are cross-posted to # newsgroup alt.fan.foo as JUNK # alt.animals.foo flag:JUNK xref:*alt.fan.foo* # # Flag any posts in any group starting with alt.disasters which are # cross-posted to any newsgroups that contain alt.aviation as XPOST # alt.disasters.* flag:XPOST xref:*alt.aviation* # # Drop any posts in any newsgroups that don't have an nntp-posting-host # header and that are cross-posted to a newsgroup that contains the # word flame. # * drop nntp-posting-host:(none) xref:*flame* # # Flag any posts in any newsgroups that passed through the news site # news.foo.com as FOO # * flag:FOO path:*news.foo.com* # # Drop any posts from i_am_a_flamer@domain that are posted to a rec # group. # In one of my edits, I lost the line that went here. # # Following added to stop stuff not caught by r.w FAQ rules rec.woodworking drop subject:*PUSSY* rec.woodworking drop subject:*cock* rec.woodworking drop subject:*COCK* rec.woodworking drop subject:*FUCK* rec.woodworking drop subject:*asshole* rec.woodworking drop subject:*swallow*cum* rec.woodworking drop subject:*cum*swallow* rec.woodworking drop subject:*uncu*penis* rec.woodworking drop subject:*joat*love* rec.woodworking drop subject:*JOAT*love* rec.woodworking drop subject:*JOAT*LOVE* rec.woodworking drop from: snipped-for-privacy@canada.com rec.woodworking drop from: snipped-for-privacy@ampfarm.com rec.woodworking drop from: snipped-for-privacy@free.linux.net.mk rec.woodworking drop from: snipped-for-privacy@gloat.org rec.woodworking drop from: snipped-for-privacy@glay.org rec.woodworking drop from: snipped-for-privacy@c895fm.com # Following from rec.woodworking FAQ rec.woodworking drop xref:*rec.pets* rec.woodworking drop xref:*:*:*:* rec.woodworking drop from:*puppy* rec.woodworking drop from:*Al Kyder* rec.woodworking drop from:*LoxFather* rec.woodworking drop from:*bwa*ha*ha* rec.woodworking drop subject:*fuck* rec.woodworking drop subject:*cocksuck* rec.woodworking drop subject:*sexy* rec.woodworking drop subject:*kyder* rec.woodworking drop subject:*sharpton* rec.woodworking drop subject:*Happy* rec.woodworking drop subject:*Ted Rumple* rec.woodworking drop subject:*GreaseBall Italian* rec.woodworking drop subject:*Spam Blocked*
Add pictures here
<% if( /^image/.test(type) ){ %>
<% } %>
<%-name%>
Add image file
Upload

The following *three* rules catch almost everything that's been problematic _recently_:
rec.woodworking drop xref:*:*:* rec.woodworking drop nntp-posting-host:.*206.216.[456] rec.woodworking drop nntp-posting-host:.*205.184.1[23456789]
Note: the preceding rules _do_ require "regular expression" patterns enabled in the nFilter/NewsProxy 'config' screen.
These rules trap: Anything cross-posted to 3 or more groups Anything from the IP addess-space assigned to ICG.net, and used in their NY area facilities. this specifically targets the idjit posting as: snipped-for-privacy@canada.com snipped-for-privacy@ampfarm.com snipped-for-privacy@free.linux.net.mk snipped-for-privacy@gloat.org snipped-for-privacy@glay.org snipped-for-privacy@c895fm.com *and* ANY OTHER NAME s/h/it might use.
_I_ haven't seen the p*ppywhiz, or kyder, or Lox, in a long time. those filters may be superfluous.
Filtering on the NNTP-Posting-Host header, if available, is an excellent way to knock out a particular poster, _regardless_ of the name he uses on the 'From: ' line. This is _always_ available, and *not* forge-able, when articles originate at Google.
If the NNTP-Posting-Host header is -not- available, then the name of the news-server that it was posted through is the 'next best thing' this is a "rec.woodworking drop path:.*}" filter line
Add pictures here
<% if( /^image/.test(type) ){ %>
<% } %>
<%-name%>
Add image file
Upload
<snip>

<snip>
I was just thinking today that I wish I could block the whole subnet of ICG.net. I guess this Nfilter is more versatile than I realized. Thanks for the tip.
todd
Add pictures here
<% if( /^image/.test(type) ){ %>
<% } %>
<%-name%>
Add image file
Upload

HomeOwnersHub.com is a website for homeowners and building and maintenance pros. It is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.