Can declude jup in here and settle this. Does filtering remove CRLFs or does it replace them with spaces???
Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Scott Fisher > Sent: Monday, December 12, 2005 3:07 PM > To: [email protected] > Subject: Re: [Declude.JunkMail] Question about filtering > > > I thought it replaced CRLF's with a space. > > ----- Original Message ----- > From: "Matt" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Monday, December 12, 2005 3:36 PM > Subject: Re: [Declude.JunkMail] Question about filtering > > > >I believe it starts immediately following the first double CFLF. > I'm not > >sure if the STARTSWITH filter for BODY is tweaked in any way, > but if it is > >it only ignores CRLF's and not other characters. > > > > Matt > > > > > > > > Kevin Bilbee wrote: > > > >>I have a problem I have been trying to solve. When a contains filter > >>comairs > >>abainst the body of the email where does that body begin? Does > it begin at > >>the mime segment or does it begin at actual content? > >> > >>For example If I have something like this > >> > >>Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com > >> (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800 > >>Received: from I295e.i.pppool.de ([85.73.41.94]) > >> by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674 > >> for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800 > >>Received: from [192.168.207.41] (port=4196 helo=parents) > >> by I295e.i.pppool.de with esmtp > >> id 7511378754121 > >> for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100 > >>MIME-Version: 1.0 > >>Content-Type: multipart/related; > >> boundary="=_469e734c3adb39df03c2f293185d8c73" > >>Message-Id: <[EMAIL PROTECTED]> > >>Date: Mon, 12 Dec 2005 21:18:36 +0100 > >>To: <[EMAIL PROTECTED]> > >>From: Jayme Dominguez <[EMAIL PROTECTED]> > >>Subject: News Alert > >> > >>--=_469e734c3adb39df03c2f293185d8c73 > >>Content-Type: text/html; charset="ISO-8859-1" > >>Content-Transfer-Encoding: quoted-printable > >> > >><Table><tr><td>This is a spam</td></tr></table> > >> > >> > >>Does the body scanning start at --= or does it start at <Table > >> > >>Kevin Bilbee > >>Network Administrator > >>Standard Abrasives, Inc. > >>[EMAIL PROTECTED] > >>(805) 520-5800 x7332 > >>____________________________________ > >>Changing the way industry works. > >> > >>--- > >>[This E-mail scanned for viruses by Declude Virus] > >> > >>--- > >>[This E-mail was scanned for viruses by Declude EVA www.declude.com] > >> > >>--- > >>This E-mail came from the Declude.JunkMail mailing list. To > >>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >>type "unsubscribe Declude.JunkMail". The archives can be found > >>at http://www.mail-archive.com. > >> > >> > >> > > --- > > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
