All geek questions in one place

Using tcpdump, how can I see the most unencrypted SMTP dialog?

I'm trying to debug an application, and this is not a convenient place to launch WireShark.

I use "tcpdump -nn -x -X port 25", but the output is not in the most convenient format. Thoughts?

+3
source share
4 answers

You can always write the tcpdump file to the file using "-w dump.txt -s 0" as additional arguments, and then upload the output file to WireShark locally.

+5
source

tcpdump -A(instead -X) will print the contents of the package in ASCII.

+1
source

, - SMTP, (, - socat ), ...

  • Use TShark to create a capture file and upload this file to WireShark somewhere more convenient.
  • Or use tcptrace on the output tcpdumpor TShark.
  • Or use tcpflow .
0
source

There is a useful utility known as ngrepthat can help you. It has all the features of regular grep, but it works with pcap data. Check here

0
source

Source: https://habr.com/ru/post/1722382/

More articles:


All Articles