I need to write a dissector that looks at all SMTP traffic searching for keywords. If the keywords are found, I want my dissector to handle it. If the keywords are not present, then let the regular smtp dissector handle it like usual.
Since the specific content is in the SMTP payload, you should look into the Internet Message Format (IMF). The dissector has settings for custom headers, maybe that can already do what you need.
The IMF dissector is called from the SMTP dissector. Is there a way that I can create a dissector to take the place of the IMF dissector without changing the call to it in the SMTP dissector? I don't want to have to build a custom Wireshark. I want to just add my own dissector (in a dll) that will replace the work done by the IMF dissector.
I had the sneaking feeling the "M" could also stand for "Military". :-) (The "United States" in the specification name suggested it, as I suspect few other parts of the US government would want their own standard.)
According to the USMTF Wikipedia page, it is "is a Military Standard collection of information exchanges, currently defined in W3C XML Schema, which seeks to improve the interoperability of Joint military systems."
It's published as MIL-STD-6040 (and apparently it may also be a NATO standard, so other NATO countries may have their own versions). It doesn't appear to be easily available to non-military personnel.
It appears to be an XML-based text format, so it was presumably developed after the MIME specifications came out. If it's implemented atop the RFC 5322 Internet Message standard, plus the RFC 2045, RFC 2046, RFC 2047, RFC 2048, and RFC 2049 MIME specifications, with a particular media type being assigned to USMTF messages, then you could register a dissector in the "media_type" dissector table, with the media-type string value as the key.
If it's not encoded using the Internet Message Format + MIME, but there is some extension to SMTP that's used to negotiate USMTF, we'd have to add a mechanism to support that mechanism.
If there's no such extension, we'd have to add support for "heuristic" dissectors to look at message bodies and dissect them if they look like messages for that type; there is no such mechanism currently available in Wireshark.
Asked: 2019-06-06 18:37:29 +0000
Seen: 410 times
Last updated: Jun 12 '19
Is the "traffic" you're searching for keywords the SMTP protocol's commands and responses or the contents of the message being transferred?
The keywords are in the contents of the message being transferred. One of the keywords I'm looking for is MSGID. It is part of a message protocol called USMTF (United States Message Text Format) in case you know what that is.