Hi,
I have added a new dissector for the IMF message format generally carried on
top of SMTP.
It provides basic dissection of the text-based IMF format and knows about
RFC2822 fields,
RFC2156 (MIXER) fields and a couple of common (e.g. Microsoft-defined)
fields - allowing for filtering.
It uses the existing multipart dissector to handle any MIME body that is
found.
It registers itself in the media-type table as "message/rfc822" - which
consequently allows it
to handle forwarded-messages.
It is currently only called from the SMTP dissector, but I will also add it
to the POP/IMAP dissectors
in due course.
Wiki page and sample captures to follow.
I would be grateful if anybody can send me example (non-ssl smtp) captures
to further test with.
Graeme
