I'm analyzing a SMTP transfer and not sure what Wireshark is reporting in the Info section of "D: DATA fragment, xx bytes". Has anyone seen this before?
asked 03 Dec '12, 13:01
The content of an email (headers + body) is sent after the SMTP DATA command. If that content is larger than one TCP segment, Wireshark will show every packet that belongs to the DATA "command" as "C: DATA fragment" in the Info column. So, those packets are basically the content of the email.
You can see the whole SMTP communication.
answered 03 Dec '12, 13:21
Kurt Knochner ♦
edited 03 Dec '12, 13:27