The Wireshark filter smtp.auth.username does great. The Info column shows the readable username. The same filter in tshark does not interpret the base64 packet content. How can I make it do that?
Pass -o smtp.decryption:TRUE to tshark.
Example without the option:
tshark -T fields -e frame.number -e smtp.auth.username -Y smtp.auth.username -r crim.pcap
63 c25lYWt5ZzMza0Bhb2wuY29t
123 c25lYWt5ZzMza0Bhb2wuY29tExample with the option:
tshark -o smtp.decryption:TRUE -T fields -e frame.number -e smtp.auth.username -Y smtp.auth.username -r crim.pcap
63 sneakyg33k@aol.com
123 sneakyg33k@aol.com
Perfect! Exactly what I needed! Thanks!
Asked: Jun 4 '18
Seen: 1,444 times
Last updated: Jun 04 '18