tshark smtp filter decode.

asked 2018-06-04 20:52:48 +0000

Will DB
1 ●2 ●1

The Wireshark filter smtp.auth.username does great. The Info column shows the readable username. The same filter in tshark does not interpret the base64 packet content. How can I make it do that?

answered 2018-06-04 21:39:29 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

Pass -o smtp.decryption:TRUE to tshark.

Example without the option:

tshark -T fields -e frame.number -e smtp.auth.username -Y smtp.auth.username -r crim.pcap
63      c25lYWt5ZzMza0Bhb2wuY29t
123     c25lYWt5ZzMza0Bhb2wuY29t

Example with the option:

tshark -o smtp.decryption:TRUE -T fields -e frame.number -e smtp.auth.username -Y smtp.auth.username -r crim.pcap
63      [email protected]
123     [email protected]

edit flag offensive delete link

Comments

Perfect! Exactly what I needed! Thanks!

Will DB ( 2018-06-04 21:48:54 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

tshark smtp filter decode.

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

tshark smtp filter decode. edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

tshark smtp filter decode.