On 3/11/2005 3:42 PM, Theo Van Dinter wrote: > On Fri, Mar 11, 2005 at 03:25:06PM -0500, Eric A. Hall wrote: > >> Extending the problem report--it seems that these rules don't fire in >> some instances. I haven't really checked this out yet, but addresses >> with a leading octet of 111, 123, and some others at or below ~130 >> seem to get skipped entirely (so does 99 and a few other two-digit >> numbers). > > Yeah, they're all listed as "reserved". See M::SA::Constants for more > detail...
I suspected as much. But even then, RCVD_NUMERIC_HELO should match in all cases because all-numeric is always illegal (regardless of the number itself, any number is illegal period). Furthermore, they should be firing on RCVD_ILLEGAL_IP since they are also illegal--bonus ratware sign. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
