Is there a filter condition matching on the file size of single attachment(s) instead of message size?

Introduction

This document describes a solution to match on attachment file size in a filter condition.

Is there a filter condition matching on the file size of single attachment(s) instead of message size?

On the Cisco Email Security Appliance (ESA), there is no option in Message Filters or Content Filters to match on attachment file size in a filter condition. The only size related condition is the Message Size condition, which is taking the size of the complete message into consideration.

The solution is to make use of the $filesizes Action Variable, which contains a comma separated list of the file size of all attachments contained in a message. If a X-header is added to the message with the value of $filesizes then a Regular Expression (RegEx) can be constructed to match if any of the contained numbers (file sizes) exceeds a certain value.

The example below shows the setup of a content filter that drops a message if  the size of attachment(s) equals to or exceeds 10000 bytes:

1. Create a Content Filter to add the value of the "$filesizes" action variable in a X-header:

   

2. Create another Content Filter to match on the file sizes contained in the new X-header, and drop the message if any of the files equals to or exceeds 10000 bytes:

   

3. Enable the two new Content Filters on all relevant Mail Policies in the above shown order.

Note: The $filesizes Action Variable is the number of bytes of the attachment, this is not related to the message size condition. Also "[1-9][0-9]{4,}" is a regular expression to match on any numbers from 10000 and upwards. If another limit is needed, the expression should be modified accordingly. For example:

    size => 20000 : [2-9][0-9]{4,}
    size => 25000 : (2[5-9][0-9]{3}|[3-9][0-9]{4,})

Related Information

• AsyncOS Email User Guide
• GLO Support Contact Information
• Technical Support & Documentation - Cisco Systems