Parser Stops Reading Received Headers Too Early!

[turetzsr]

...TRACKING URL for parse of spam I submitted by forwarding to my secret e-mail address: http://www.spamcop.net/sc?id=z701233691z6a...16b3ce56ee396az. This parse stopped too early, thus wanting to LART my employer's abuse address (actually postmaster[at] ...). However, the following Received addresses follow the ones it did parse:

Received: from +¦¦T¦µ ([211.58.70.161]unverified) by usbb-lacimss1 with InterScan Messaging Security Suite; Fri, 10 Dec 2004 15:02:13 -0500
Received: from zealot.UMKC.EDU (zealot.UMKC.EDU)
[tab] by zealot.UMKC.EDU (zealot.UMKC.EDU) with ESMTP
[tab] id XSD76009767X; Fri, 10 Dec 2004 12:51:36 -0600

That first one looks odd but when I cut and pasted into the two-part web form, the parser had no problem with it: http://www.spamcop.net/sc?id=z701237359z65...174a45f9e700bez.

...Any thoughts? Foulup by my employer's system (Exchange 2003)? Worth my sending to the deputies?

[Ellen]

...TRACKING URL for parse of spam I submitted by forwarding to my secret e-mail address:  http://www.spamcop.net/sc?id=z701233691z6a...16b3ce56ee396az.  This parse stopped too early, thus wanting to LART my employer's abuse address (actually postmaster[at] ...).  However, the following Received addresses follow the ones it did parse:

Received: from +¦¦T¦µ ([211.58.70.161]unverified) by usbb-lacimss1 with InterScan Messaging Security Suite; Fri, 10 Dec 2004 15:02:13 -0500
Received: from zealot.UMKC.EDU (zealot.UMKC.EDU)
[tab] by zealot.UMKC.EDU (zealot.UMKC.EDU) with ESMTP
[tab] id XSD76009767X; Fri, 10 Dec 2004 12:51:36 -0600

That first one looks odd but when I cut and pasted into the two-part web form, the parser had no problem with it: http://www.spamcop.net/sc?id=z701237359z65...174a45f9e700bez.

...Any thoughts?  Foulup by my employer's system (Exchange 2003)?  Worth my sending to the deputies?

21241[/snapback]

I seem to be totally confused. The format of the header following all the unisys server headers that pass around the email is not a format recognizable by the parser. Whatever you copy/pasted to get it to work must have contained a received header that looked rational?

[Jeff G.]

It appears that your forwarding methodology encoded

Received: from +¦¦T¦µ ([211.58.70.161]unverified) by usbb-lacimss1 with InterScan Messaging Security Suite; Fri, 10 Dec 2004 15:02:13 -0500

into

Received: =?iso-8859-1?Q?_from_+=A6=A6T=A6=B5_=28=5B211=2E58=2E70=2E161=5Dunverif?=

=?iso-8859-1?Q?ied=29_by_usbb-lacimss1_with_InterScan_Messaging_Security_?=

=?iso-8859-1?Q?Suite=3B_Fri=2C_10_Dec_2004_15=3A02=3A13_-0500?=

when it shouldn't have. Have you tried forwarding using a different encoding and/or swapping between body and attachment?

OTOH, why didn't the email reporting to parsing conversion decode that Line correctly?

[turetzsr]

Hi, Ellen!

I seem to be totally confused. The format of the header following all the unisys server headers that pass around the email is not a format recognizable by the parser. Whatever you copy/pasted to get it to work must have contained a received header that looked rational?

21243[/snapback]

...Not sure why you are confused nor about which parse you are confused. Is it what I included in the "code" section of my post here or what is in one of the tracking URLs? If the latter, I can't speak to what happened -- you may have to ask Julian. As to the former, I copied the headers exactly as they are displayed in my Microsoft Outlook 2003 client (Exchange 2003 Server) when I display them with View | Options (in the Internet headers section). The latter is also what I copied and pasted into the web submission form whose parse is represented by the second of my tracking URLs.

[turetzsr]

Hi, Jeff G!

It appears that your forwarding methodology encodedintowhen it shouldn't have.  Have you tried forwarding using a different encoding and/or swapping between body and attachment?

21247[/snapback]

...No. Not quite sure why you believe that would be a reasonable course of action....

OTOH, why didn't the email reporting to parsing conversion decode that Line correctly?

21247[/snapback]

...Exactly!

[Ellen]

Hi, Ellen!...Not sure why you are confused nor about which parse you are confused.  Is it what I included in the "code" section of my post here or what is in one of the tracking URLs?  If the latter, I can't speak to what happened -- you may have to ask Julian.  As to the former, I copied the headers exactly as they are displayed in my Microsoft Outlook 2003 client (Exchange 2003 Server) when I display them with View | Options (in the Internet headers section).  The latter is also what I copied and pasted into the web submission form whose parse is represented by the second of my tracking URLs.

21303[/snapback]

Paste in a copy of the spam with headers to my address below and also the tracking url and let us smash it around. Very strange.

[turetzsr]

Hi, Ellen!

Paste in a copy of the spam with headers to my address below and also the tracking url <snip>.

21360[/snapback]

...Done. E-mail subject is "Re: Parser Stops Reading Received Headers Too Early!"

...TY! <g>

[Ellen]

Hi, Ellen!...Done.  E-mail subject is "Re: Parser Stops Reading Received Headers Too Early!"

...TY! <g>

21362[/snapback]

Thanks Julian and I muttered over this for a considerable time this morning and he was still muttering when I went off to do something else :-) That usually means a fix is in progress.