Wireshark-users: Re: [Wireshark-users] Help using this forum
From: "Andrew Cuthbertson" <[email protected]>
Date: Thu, 5 Jun 2008 19:06:34 +0200
Thanks for the info. I'll try and avoid "From" at the begining of a line

-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Guy Harris
Sent: 04 June 2008 19:27
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Help using this forum

Andrew Cuthbertson wrote:

> 1. I sent one mail with a few questions and it was split over multiple
> messages on the archive. So what is the message size limit to keep the
> question in one message?

The message size appears to be limited to "everything up to the first
occurrence of the word 'From' at the beginning of a line, followed by a

The archiving software appears to have a bug (the problem is probably
that in traditional UN*X "mbox" format for storing collections of mail
messages, the separator between mail messages is an ancient UN*X-style
"From" line, which begins with "From ", and that's probably confusing
the archiving software; other mail software puts ">" in front of "From",
to prevent this problem).

I've filed bug 2586 in the Wireshark bugzilla on this problem.

> 2. I do not know how to post a reply to a mail archive so that it would be
> appended to the right thread. How is this done?

By replying with a mail program that adds an "In-Reply-To:" or
"References:" header indicating to what message it's a reply or what the
other messages in the thread, including the message to which it's a
reply, are.

I don't know which software that would be, but that doesn't appear to
include "Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)" plus
Microsoft's "MimeOLE V6.00.2900.3198" - which isn't a complete surprise
to me; I seem to remember filing an RFE against Apple's Mail application
to get it to recognize the non-standard threading information
Outlook/Exchange add to messages, although I can't find the bug now.

The copy of a message you sent as a reply to your original "Help needed
controlling tshark output format" that I received doesn't appear to have
*any* threading information in it; whether that's because the mail
software at your site didn't put any in the message, or it got stripped
out by some of the software between it and my mailbox, is another matter.

Wireshark-users mailing list
[email protected]