On Thu, 8 Dec 2011, Matus UHLAR - fantomas wrote:
If you're trying to match on RFC822 attached emails, you'll need to use the
"mimeheader" rule type,
I am afraid this does not apply to Received: headers.
It shouldn't apply to any of the headers in the attached message.
mimeheader is for the MIME headers in the message part, not for the
_contents_ of the attachment.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The question of whether people should be allowed to harm themselves
is simple. They *must*. -- Charles Murray
-----------------------------------------------------------------------
7 days until Bill of Rights day
