>Is it: Received: from.*?(\[\d+\.\d+\.\d+\.\d+\].*?).*?by >fallback.deurne.nl
??? The example I give in the GUI is: Received: from.*?(\d+\.\d+\.\d+\.\d+).*?by (mx.yourisp.com|my.secondary.org) so my guess is: Received: from.*?(\d+\.\d+\.\d+\.\d+).*?by fallback.deurne.nl ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test