SA 3.4.6. Is there any way to create a rule that hits emails with duplicate filename attachments?
MAIN HEADER DECLARATION: Content-Type: multipart/mixed; boundary="=-6aIz+S039AYG/4raFdExeg==" BODY PART MIME HEADERS: --=-6aIz+S039AYG/4raFdExeg== Content-Type: application/octet-stream; name=1341251248.pdf Content-Disposition: attachment; filename=1341251248.pdf Content-Transfer-Encoding: base64 <BASE64 stuff here> --=-6aIz+S039AYG/4raFdExeg== Content-Type: application/octet-stream; name=1341251248.pdf Content-Disposition: attachment; filename=1341251248.pdf Content-Transfer-Encoding: base64 <same BASE64 stuff here> I can hit on the Content-Disposition header regex fine, but tflags/multiple doesn't seem to work here. I'm not sure if this is a problem (1) with the Mimeheader plugin, (2) working as designed, (3) or a fault in my system. Any suggestions? Thanks, -- Jared Hall
