by FieldDir121 » Fri Jan 20, 2006 7:40 am
The code is below. I tried using both spaces and tabs but they are all converted to a single space in the preview window. I can send the script as a file so that the indentations and comment spacing will be preserved. Every line is commented since I am still learning. Once I get more proficient the comments will be less prolific.
If the code fails to find the received line or the brackets it just goes on anyway. Error handling didn't seem worth it at this point. I may add it later when I finish the file handling portion.
I cleaned up the subject portion. DisplayOriginatingIPaddress truncated the last two characters from the subject. I also added single quotes around the subject (because I didn't know how to add double quotes). Also, I found the lower case L a bit confusing as it resembles a 1 in some fonts, so I changed it to a "z".
I included the square brackets because I like them. Also, my filter sees this: [192.168.1.1] differently than it sees this: 192.168.1.1. 192.168.1.1 can be anything from 192.168.1.10 to 192.168.1.19 and 192.168.1.100 to 192.168.1.199. The brackets restrict the address to a single value. Since this will be an automated extraction script I do not want to unintentionally include any addresses not specifically targeted. So far my false positive rate seems to be zero (0) in over six months.
[code]
{ DisplayMostRecentIPAddress - Version 1.00
{ Author: Scott Taylor - January, 19, 2006
{
{ Used DisplayOriginatingIPAddress - Version 1.00 as a starting point
{ Author: Michael Motek - July 27, 2001
{
{ Purpose: Extract the most recent IP address from the receive header to gather addresses used
{ by spam sources.
{
{ Method: The script finds the first (most recent) "Received" header of a message. The string in that
{ line bracketed by square brackets ("[" and "]") is reported along with the message subject.
ReadAllHeaders $headers %message { put entire header of current message into variable "$headers"
Set $MostRecentIPAddr "" { clear variable $MostRecentIPAddr
:RcvdLoop
LocateLine #z "Received:" $headers { finds the first occurance of "Received:" in $headers
If #z < 0 Then Done { done if not found, don't bother with error handling
GetLine $line #z $headers { put line number in $line
StringPos #z "[" $line { find opening bracket
If #z = 0 Then done { done if not found
Dec #z { decrement to leave opening bracket
ChopString $line 1 #z { delete characters before opening bracket
StringPos #z "]" $line { find closing bracket
If #z = 0 Then done { done if not found
Inc #z { increment to leave closing bracket
ChopString $line #z 9999 { delete everything after closing bracket
Set $MostRecentIPAddr $line
:Done
ReadHeader $subject "Subject:" %message { get subject line, put in variable $subject
Set $msg "The most recent IP address for message '" { put string in $msg
AddStrings $msg $subject "' was: " $MostRecentIPAddr { put strings together for display
MessageBox $msg { display message
[/code]