Wireshark-users: Re: [Wireshark-users] Help using this forum

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 04 Jun 2008 10:27:10 -0700

Andrew Cuthbertson wrote:

1. I sent one mail with a few questions and it was split over multiple
messages on the archive. So what is the message size limit to keep the
question in one message?

The message size appears to be limited to "everything up to the first occurrence of the word 'From' at the beginning of a line, followed by a blank".

The archiving software appears to have a bug (the problem is probably that in traditional UN*X "mbox" format for storing collections of mail messages, the separator between mail messages is an ancient UN*X-style "From" line, which begins with "From ", and that's probably confusing the archiving software; other mail software puts ">" in front of "From", to prevent this problem).

I've filed bug 2586 in the Wireshark bugzilla on this problem.

2. I do not know how to post a reply to a mail archive so that it would be
appended to the right thread. How is this done?

By replying with a mail program that adds an "In-Reply-To:" or "References:" header indicating to what message it's a reply or what the other messages in the thread, including the message to which it's a reply, are.

I don't know which software that would be, but that doesn't appear to include "Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)" plus Microsoft's "MimeOLE V6.00.2900.3198" - which isn't a complete surprise to me; I seem to remember filing an RFE against Apple's Mail application to get it to recognize the non-standard threading information Outlook/Exchange add to messages, although I can't find the bug now.

The copy of a message you sent as a reply to your original "Help needed controlling tshark output format" that I received doesn't appear to have *any* threading information in it; whether that's because the mail software at your site didn't put any in the message, or it got stripped out by some of the software between it and my mailbox, is another matter.