Let's clarify a couple of things that might have been confused here. The original question was asking where the BODY begins. That is what my response was addressing. When it comes to filtering line breaks, that is a totally different story and it is not the question that I answered. Within the BODY, CRLF's are in fact replaced with spaces. So considering both, in the example that you gave, you would need to construct a filter that had the following (ignore line breaks if inserted by your E-mail client and pay attention to spaces): BODY 15 STARTSWITH --=_469e734c3adb39df03c2f293185d8c73 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable <Table>Since almost every E-mail has a different boundary (that first string of characters), you can't use Declude's built-in filtering to check if a multipart message starts with a <TABLE> tag. If you are looking at single part messages, ones that have no MIME boundaries and has only one body segment, you can in fact construct a filter that checks to see if the body starts with a <TABLE> tag. I doubt that is of any use considering the thread. Inside joke follows: A++++++++ Would recommend to anyone!!! Matt Kevin Bilbee wrote: So with this -Subject: News Alert--=_469e734c3adb39df03c2f293185d8c73 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable <Table><tr><td>This is a spam</td></tr></table>I would need to do the following if I was looking for <table at the beginning of a message BODY 15 CONTAINS Content-Transfer-Encoding: quoted-printable<Table This assumes the CRLF codes are striped instead of replaced. Kevin Bilbee-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Matt Sent: Monday, December 12, 2005 1:37 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Question about filtering I believe it starts immediately following the first double CFLF. I'm not sure if the STARTSWITH filter for BODY is tweaked in any way, but if it is it only ignores CRLF's and not other characters. Matt Kevin Bilbee wrote:I have a problem I have been trying to solve. When a containsfilter comairsabainst the body of the email where does that body begin? Doesit begin atthe mime segment or does it begin at actual content? For example If I have something like this Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800 Received: from I295e.i.pppool.de ([85.73.41.94]) by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674 for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800 Received: from [192.168.207.41] (port=4196 helo=parents) by I295e.i.pppool.de with esmtp id 7511378754121 for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100 MIME-Version: 1.0 Content-Type: multipart/related; boundary="=_469e734c3adb39df03c2f293185d8c73" Message-Id: <[EMAIL PROTECTED]> Date: Mon, 12 Dec 2005 21:18:36 +0100 To: <[EMAIL PROTECTED]> From: Jayme Dominguez <[EMAIL PROTECTED]> Subject: News Alert --=_469e734c3adb39df03c2f293185d8c73 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable <Table><tr><td>This is a spam</td></tr></table> Does the body scanning start at --= or does it start at <Table Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 ____________________________________ Changing the way industry works. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.--- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus]--- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. |
- Re: [Declude.JunkMail] Question about filtering Matt
- RE: [Declude.JunkMail] Question about filtering Kevin Bilbee
- [Declude.JunkMail] Way OT: Future Broadband - Ve... Dave Doherty
- Re: [Declude.JunkMail] Way OT: Future Broadb... Darin Cox
- [Declude.JunkMail] Declude and IMail 200... Dan Geiser
- RE: [Declude.JunkMail] Declude and ... John T \(Lists\)
- [Declude.JunkMail] Decludeproc ... Harry Vanderzand
- RE: [Declude.JunkMail] Decl... John T \(Lists\)
- RE: [Declude.JunkMail] Decl... Harry Vanderzand
- Re: [Declude.JunkMail] Decl... Bill Landry
- Re: [Declude.JunkMail] Declude ... Dan Geiser