Darin,
Outlook will strip many of the headers when forwarding. Outlook
Express needs to forward the messages using "Forward As Attachment" in
order to insert the full original headers. Thunderbird/Netscape Mail
will work just by forwarding. If you paste the full source in a
message, you should send as plain text.
I have many FP's that come back as having no rules found, but these are
more likely to be from rules that were already removed. So I wouldn't
jump to a conclusion that the rule was not found because of formatting
unless you are not sending the full unadulterated original message
source. I would imagine that it would mostly be IP rules that aren't
found when not forwarding the full original source.
Matt
Darin Cox wrote:
It is unclear - we receive FPs that have traveled through all sorts of
clients, quarantine systems, changed hands various numbers of times,
or not (to all of those)... Right now I don't want to make that
research project a high priority.
Understood.
That's true it wouldn't change, but submitting the message directly
would not be correct - the dialogue is with you, and in any case,
additional trips through the mail server also modify parts of the
header and sometimes parts of the message (tag lines, disclaimers,
etc)...
Hmmm... with attaching the original message, I guess it still makes more
sense to deliver to us first for now. Just looking for an alternative that
gets you the message as close as possible to the original form as possible.
Maybe we'll write a script to copy and forward the D*.SMD file as an
attachment to you for FPs at some point in the future.
#############################################################
This message is sent to you because you are subscribed to
the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
|
