Complex statistical problem - help!

CJi

Dear all,

I hope someone on here can assist me in my dilemma. I am currently writing a program to help fight spam. To give you some background, it works as follows:

Entire email (plus headers) are pasted into a text box.
Upon submit, the php script parses the received lines (and other parts, irrelevant to this problem) and identifies the IP addresses of the relays. Various checks are conducted on these IPs, and the results eventually stored in a database (and other functions, again not relevant to this problem).

What I need to do is look up the IP address in the database (schema not yet formulated) and identify previous spam received from the various netblocks (/32, /24, /21, etc.) and count the hits, per netblock to give some idea of the 'spamability' of email from this netblock being, well, spam. This will be run for each relay in the header.

Hopefully this gives enough detail of what I'm trying to accomplish.. but if not, if anyone thinks they can help, please post with any questions you have and I will gladly reply in more detail.

Thanks in advance,

Lee.

AstroTeg

You trying to figure out how to store the IP? Or trying to figure out how to query with the count function?

CJi

If only the problem were that simple. I can manage both of those.

What I need to do is the following: (I didn't think I'd explained it well enough first time round.)

Example:
$relay_ip = "62.49.139.88";

Assuming there are 4 hits for this IP, and 2 for 62.49.139.55 already,

A cidr check on this for a /32 will reveal 4 matches.
A cidr check on this for a /24 will reveal 6 matches, and so on.

What I need is (ideally) an array which will return the following:

$cidr_results[0] = 4 //32
$cidr_results[1] = 6 //24

and so one thru the array for a /32, /24, /21, etc.

Does that make more sense? If you don't understand how CIDR conotations works, that probably won't make sense.

AstroTeg

I'm down with CIDR. In fact, I'd say SWITCH from CIDR. Its going to slow you down. 🙂

Use integer notation (or at least store the IP as an integer). It'll allow you to do your masking much easier. You'll want to check out [man]ip2long[/man].

Some code swiped from jbothe at hotmail dot com's post:

   $ip_addr = "172.14.1.57";
   $subnet_mask = "255.255.255.0";

   $ip = ip2long($ip_addr);
   $netmask = ip2long($subnet_mask);
   $networkaddress = ($ip & $netmask);
   $broadcastaddress = $networkaddress | (~$netmask);

You can then determine your host range:

echo "Host Range:        " . long2ip($networkaddress + 1) . " -> " . long2ip($broadcastaddress - 1)  . "\n";

And with that info, you can then query your database and issue a count. If you're database supports subselects, then you can pile this all into one query.

CJi

Hmm, hadn't thought of that I must admit.

Thanks very much indeed!