Wireshark · Ethereal-dev: [Ethereal-dev] FW: [Ethereal-users] post processing script for "-R msnms -V"

[Biot Olivier <Olivier.Biot@xxxxxxxxxxx>]

FYI

-----Original Message-----
From: Jeff Dickens

The "msnms" display filter, for MSN Messenger traffic, doesn't display the
text of messages when you use it without -V.  With -V, the output is
understandably verbose.

I wrote the following script to take the verbose output and generate a
concise chat transcript.  It's not perfect; for one it can't keep track of
the sender's id for messages originating locally.  But it's otherwise pretty
good, I think.

Enjoy.

#!/usr/bin/perl -w

while (not eof()) {     # Exit when all of file has been processed. Skip
down
  while (<>) {          # to "MSN Messenger" decode. Remember time, src, dst
    ($atime) = /\s*Arrival Time:\s(\S+\s\d+,\s\d+\s\d+:\d+:\d+).*/
      if (/\s*Arrival Time:\s.*/);
    ($src) = /\s*Source:\s(\S+).*/ if (/\sSource:\s.*/);
    ($dst) = /\s*Destination:\s(\S+).*/ if (/\sDestination:\s.*/);
    last if /MSN Messenger Service/;
  }
  $ctyp = $user = $msg = "";
  while (<>) {          # Process each line of Message decode
    chomp;              # Remember MSG "from" and content type for each
message
    s/\\r\\n//;
    if (/.*\s+MSG\s+.+/) { ($user) = /\s+MSG\s+(\S*).+/; next }
    if (/.*Content-Type:.*/) { ($ctyp) = /\s+Content-Type:\s+(\S*).*/;
next }
    next if /.*MIME-Version:.*/;
    next if /.*X-MMS-IM-Format:.*/;
    $msg .= "$_\n";     # append message text onto msg
    last if $_ eq "";
  }
  next unless $ctyp eq "text/plain;";           # Skip all control messages
  print "$atime ($user) $src => $dst\n$msg\n";  # Print the rest
}