Re: [tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Leonard Mills
At about Friday, April 3, 2009 4:01:05 AM Shameem Ahamed wrote: ... >In that one also, i have tried to print the data part in a file using the >callback function and all the data was in binary format. ... If you're seeing binary during SMTP DATA and it's not in a binary MIME part/attachment,

Re: [tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Tobias Weber
On 03.04.2009, at 17:14, Shameem Ahamed wrote: Problem is , when i try to print the payload (It is represented as a pointer to the u_char data type), it gives me binary data , of course it includes some ascii data ( the http request headers). Is one of them, by any chance, "Content-Encoding

Re: [tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Shameem Ahamed
Hello Julian, I am analyzing the HTTP protocol itself. Problem is , when i try to print the payload (It is represented as a pointer to the u_char data type), it gives me binary data , of course it includes some ascii data ( the http request headers). My inference is the e-mail content and

Re: [tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Julian Mehnle
Shameem Ahamed wrote: > Yes, i am getting the payload. But the only thing is the payload is in > binary format. I have no idea what that means. What protocol are you trying to analyze? HTTP? SMTP? If it's either of those, then there's nothing particularly "binary" about them, unless HTTP com

Re: [tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Shameem Ahamed
Hello Julian, Please see my reply below. "If you register a TCP (not IP or UDP!) callback with libnids, it will just give you the payload data, no packet headers or anything. If this is not what you're getting, you're doing something wrong and should reread the documentation." Yes, i am

Re: [tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Julian Mehnle
Shameem Ahamed wrote: > I have tried a small code with libnids in my ubuntu machine. > > I have modified the sample code provided by Rafal Wojtczuk in the > libnids main page. > > In that one also, i have tried to print the data part in a file using > the callback function and all the data was

Re: [tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Shameem Ahamed
Hello Julian, Thanks for the reply. I have tried a small code with libnids in my ubuntu machine. I have modified the sample code provided by Rafal Wojtczuk in the libnids main page. In that one also, i have tried to print the data part in a file using the callback function and all the da

Re: [tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Julian Mehnle
Shameem Ahamed wrote: > I want to get the e-mail details (Email Body, Subject, To, CC and > attachment details) from the e-mail send pcap i created using > wireshark. > > Can any one help me regarding this ?. > > I am doing a project to capture and present high level (layer 7) data > content(paylo

[tcpdump-workers] Email Content Extraction From payload

2009-04-03 Thread Shameem Ahamed
Hi All, I want to get the e-mail details (Email Body, Subject, To, CC and attachment details) from the e-mail send pcap i created using wireshark. Can any one help me regarding this ?. I am doing a project to capture and present high level (layer 7) data content(payload) from pcap file Rega