Wireshark-dev: Re: [Wireshark-dev] SMTP: Extracting parametrs
From: "Abhik Sarkar" <[email protected]>
Date: Mon, 12 May 2008 12:13:04 +0400
Perhaps you could explore the use of the "customer columns" feature
that was recently introduced. This is not exactly what you are looking
for but might work out better than a dialog since it is non-obtrusive.
You will want to experiment with the following fields:
imf.from
imf.to
imf.subject
imf.date

You can check out how to setup custom columns in this video:
http://ie.youtube.com/watch?v=XpUNXDkfkQg

Hope this helps.
Abhik.

2008/5/10 goitom kahsay <[email protected]>:
> Hello,
>   How can i  extract these values (From, TO ,Subject and Date) from the SMTP
> packets displayed  in the packet list pane in to a new dialog.
>
> Any idea!
>
>
> Thank u in  advance
>
> On Thu, May 1, 2008 at 1:37 AM, Stig Bjørlykke <[email protected]>
> wrote:
>>
>> On 30. april. 2008, at 09.44, goitom kahsay wrote:
>>
>> > How can i extract the SMTP parameters such as FROM,TO,SUBJECT,DATE
>> > and ... from SMTP packets?
>>
>>
>> Hi.
>>
>> I don't know where you want the output, but the SMTP dissector is
>> using the IMF dissector, so it's possible to use tshark to print the
>> values like this:
>>
>> $ tshark -r smtp_data.pcap -e imf.from -e imf.to -e imf.subject -T
>> fields
>>
>> Or you could simply dump all fields and do a grep, like this:
>>
>> $ tshark -V -r smtp_data.pcap | egrep "Subject:|From:|To:|Date:"
>>
>>
>> --
>> Stig Bjørlykke
>>
>>
>> _______________________________________________
>> Wireshark-dev mailing list
>> [email protected]
>> http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
>
>
> --
> Benice2all
> _______________________________________________
> Wireshark-dev mailing list
> [email protected]
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
>