IronPort - advanced configuration guide

Body Size Rule
Remote IP Rule
6-24
Cisco IronPort AsyncOS 7.6 for Email Advanced Configuration Guide
Chapter 6 Using Message Filters to Enforce Email Policies
Body size refers to the size of the message, including both headers and attachments. The body-size rule
selects those messages where the body size compares as directed to a given number. For example, the
following filter bounces any message where the body size is greater than 5 megabytes.
BigFilter:
if (body-size > 5M)
{
}
bounce();
The body-size can be compared in the following ways:
Example Comparison Type
body-size < 10M Less than
body-size 10M Greater than
body-size >= 10M Greater than or equal
body-size == 10M Equal
body-size != 10M Not equal
As a convenience, the size measurement may be specified with a suffix:
Quantity Description
10b ten bytes (same as 10)
13k thirteen kilobytes
5M five megabytes
40G 40 gigabytes (Note: The Cisco IronPort appliance cannot accept messages larger than
100 megabytes.)
The remote-ip rule tests to see if the IP address of the host that sent that message matches a certain
pattern. The IP address can be either Internet Protocol version 4 (IPv4) or Internet Protocol version 6
(IPv6). The IP address pattern is specified using the allowed hosts notation described in “Sender Group
Syntax” in the Cisco IronPort AsyncOS for Email Configuration Guide, except for the SBO, SBRS,
dnslist notations and the special keyword ALL.
OL-25137-01