Ethereal-users: Re: [Ethereal-users] display filter for pop3?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Mon, 6 Mar 2006 11:26:47 +0100
On Mon, Mar 06, 2006 at 11:07:14AM +0100, Agryppa wrote:
> Dnia poniedzia??ek, 6 marca 2006 10:57, Guy Harris napisa??:
> 
> > That will find a *single TCP segment* that has POP traffic where the POP
> > traffic has both "USER" and "RETR".
> >
> > Is that what you're trying to find?
> Well, my intention is mimick what I achieved in smtp traffic:
> 
> "smtp contains FROM or smtp contains RCPT"
> 
> This way I can see from what address to what address the mail is sent and I 
> can use Follow TCP Stream to monitor the entire conversation.
> Can that be done for POP?

How'bout "pop contains USER or pop contains RETR", that will show you all
packets with usernames and all packets with a RETR command in them. A little
searching and "follow-tcp-streams" might just get you what you are
looking for :)


Cheers,  Sake