Fragmented message query

[Randal, Phil]

Outlook Express is one of the monsters which can produce these.

Basically, "large" emails are split into several unique emails (Part 1
of n, etc, a bit lie alt.binaries.... postings) which are reconstructed
in the email client at the recipient's end.  This makes it impossible
for MailScanner and any virus scanners to scan the content.

Best solution is to educate the senders, but failing that you can make a
ruleset to let some through.  I wouldn't unless all your desktop PCs are
properly protected against malware, because you won't find anything
until the bunch of messages are reassembled on the user's PC.

Highly dangerous...

Cheers,

Phil
----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Michele 
> Neylon :: Blacknight Solutions
> Sent: 14 June 2005 11:55
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Fragmented message query
> 
> One of our beloved clients corresponds with a company whose 
> mail server is doing odd things to mail. MS reports the following:
> "MailScanner: Fragmented messages cannot be scanned and are removed"
> 
> What exactly is a "fragmented message"?
> 
> Can I whitelist it or will it be caught by the default checks?
> 
> Sorry if this is basic question, but my head hurts trying to 
> think of a solution :)
> 
> Mr Michele Neylon
> Blacknight Internet Solutions Ltd
> Hosting, co-location & domains
> http://www.blacknight.ie/
> Tel. +353 59 9137101 | Fax. +353 59 9146970 Tired of your 
> current host? Save 15% when you move to us!
> 
> ------------------------ MailScanner list 
> ------------------------ To unsubscribe, email 
> jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) 
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!