Wireshark-users: Re: [Wireshark-users] Help using this forum
From: Guy Harris <[email protected]>
Date: Wed, 04 Jun 2008 10:27:10 -0700
Andrew Cuthbertson wrote:

1. I sent one mail with a few questions and it was split over multiple
messages on the archive. So what is the message size limit to keep the
question in one message?
The message size appears to be limited to "everything up to the first 
occurrence of the word 'From' at the beginning of a line, followed by a 
The archiving software appears to have a bug (the problem is probably 
that in traditional UN*X "mbox" format for storing collections of mail 
messages, the separator between mail messages is an ancient UN*X-style 
"From" line, which begins with "From ", and that's probably confusing 
the archiving software; other mail software puts ">" in front of "From", 
to prevent this problem).
I've filed bug 2586 in the Wireshark bugzilla on this problem.

2. I do not know how to post a reply to a mail archive so that it would be
appended to the right thread. How is this done?
By replying with a mail program that adds an "In-Reply-To:" or 
"References:" header indicating to what message it's a reply or what the 
other messages in the thread, including the message to which it's a 
reply, are.
I don't know which software that would be, but that doesn't appear to 
include "Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)" plus 
Microsoft's "MimeOLE V6.00.2900.3198" - which isn't a complete surprise 
to me; I seem to remember filing an RFE against Apple's Mail application 
to get it to recognize the non-standard threading information 
Outlook/Exchange add to messages, although I can't find the bug now.
The copy of a message you sent as a reply to your original "Help needed 
controlling tshark output format" that I received doesn't appear to have 
*any* threading information in it; whether that's because the mail 
software at your site didn't put any in the message, or it got stripped 
out by some of the software between it and my mailbox, is another matter.