Kevin,
Yes, that filter should work.
Matt
Kevin Bilbee wrote:
Ok that make good sence so do you think this
will work
BODY 15 CONTAINS
Content-Transfer-Encoding: quoted-printable <Table>
Which is what I asked in the message you replied
to?
Let's clarify a couple of things that might have been confused here.
The original question was asking where the BODY begins. That is what
my response was addressing.
When it comes to filtering line breaks, that is a totally different
story and it is not the question that I answered. Within the BODY,
CRLF's are in fact replaced with spaces.
So considering both, in the example that you gave, you would need to
construct a filter that had the following (ignore line breaks if
inserted by your E-mail client and pay attention to spaces):
BODY 15 STARTSWITH
--=_469e734c3adb39df03c2f293185d8c73 Content-Type: text/html;
charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable
<Table>
Since almost every E-mail has a different boundary (that first string
of characters), you can't use Declude's built-in filtering to check if
a multipart message starts with a <TABLE> tag. If you are
looking at single part messages, ones that have no MIME boundaries and
has only one body segment, you can in fact construct a filter that
checks to see if the body starts with a <TABLE> tag. I doubt
that is of any use considering the thread.
Inside joke follows: A++++++++ Would recommend to anyone!!!
Matt
Kevin Bilbee wrote:
So with this -
Subject: News Alert
--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
<Table><tr><td>This is a spam</td></tr></table>
I would need to do the following if I was looking for <table at the
beginning of a message
BODY 15 CONTAINS Content-Transfer-Encoding: quoted-printable<Table
This assumes the CRLF codes are striped instead of replaced.
Kevin Bilbee
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Matt
Sent: Monday, December 12, 2005 1:37 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Question about filtering
I believe it starts immediately following the first double CFLF. I'm
not sure if the STARTSWITH filter for BODY is tweaked in any way, but if
it is it only ignores CRLF's and not other characters.
Matt
Kevin Bilbee wrote:
I have a problem I have been trying to solve. When a contains
filter comairs
abainst the body of the email where does that body begin? Does
it begin at
the mime segment or does it begin at actual content?
For example If I have something like this
Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com
(SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800
Received: from I295e.i.pppool.de ([85.73.41.94])
by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674
for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800
Received: from [192.168.207.41] (port=4196 helo=parents)
by I295e.i.pppool.de with esmtp
id 7511378754121
for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="=_469e734c3adb39df03c2f293185d8c73"
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 12 Dec 2005 21:18:36 +0100
To: <[EMAIL PROTECTED]>
From: Jayme Dominguez <[EMAIL PROTECTED]>
Subject: News Alert
--=_469e734c3adb39df03c2f293185d8c73
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
<Table><tr><td>This is a spam</td></tr></table>
Does the body scanning start at --= or does it start at <Table
Kevin Bilbee
Network Administrator
Standard Abrasives, Inc.
[EMAIL PROTECTED]
(805) 520-5800 x7332
____________________________________
Changing the way industry works.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail scanned for viruses by Declude Virus]
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
|
