Wireshark-dev: [Wireshark-dev] New Internet Message Format (RFC2822) Dissector

From: "Graeme Lunt" <graeme.lunt@xxxxxxxxx>
Date: Wed, 4 Jul 2007 18:36:59 +0200

Hi,

I have added a new dissector for the IMF message format generally carried on
top of SMTP.
It provides basic dissection of the text-based IMF format and knows about
RFC2822 fields,
RFC2156 (MIXER) fields and a couple of common (e.g. Microsoft-defined)
fields - allowing for filtering.

It uses the existing multipart dissector to handle any MIME body that is
found. 

It registers itself in the media-type table as "message/rfc822" - which
consequently allows it 
to handle forwarded-messages.

It is currently only called from the SMTP dissector, but I will also add it
to the POP/IMAP dissectors 
in due course.

Wiki page and sample captures to follow.

I would be grateful if anybody can send me example (non-ssl smtp) captures
to further test with.

Graeme