Wireshark-users: Re: [Wireshark-users] Post-Filter setup
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Sat, 10 Jun 2006 00:30:10 +0200
On Fri, Jun 09, 2006 at 02:56:15PM -0600, David Peat wrote:
>
> I need to create a post-filter to look at SMTP traffic that has BOTH the
> sender and recipient with the same domain name.

This is not easily possible with ethe^H^H^H^Hwireshark. The display
filters work on single packets and not on tcp-sessions. Since the SMTP
protocol is a command-response protocol, the sender address (in the
MAIL FROM: command) is in one packet and the recipient address (in
the RCPT TO: command) is in another packet.

What you could use is MATE (see http://wiki.wireshark.org/Mate), with
mate you can define which packets relate to each other. You can then
add fields (like sender and recipient) and filter on them.

There is also LUA, a scripting language inside wireshark, but I have
not yet used that myself...

Of course you could also do some shell-scripting around tshark... :)


I hope this helps :)


Cheers,   Sake
~