This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

PCAP file generation using wireshark for SMTP, POP3 and IMAP

How do i generate pcap files for protocols such as SMTP, POP3 and IMAP. I need to send a email with attachments and capture the same as pcap file. I dont know how to generate pcap file for above mentioned protocols. Please help me out.

pop3 pcap smtp imap wireshark

asked 27 Jun '15, 15:56

kruthi
11●2●2●4
accept rate: 0%

I need to send a email with attachments and capture the same as pcap file. I dont know how to generate pcap file for above mentioned protocols.

How do you do that? Well, by sending an e-mail from A to B via SMTP and by capturing that traffic between A and B. Same for POP3, IMAP for the e-mail download.

This sounds a bit like a homework assignment, and you are trying to take the easy route by crafting a pcap file instead of doing the whole E-Mail part ;-)) Am I right with my assumption?

(28 Jun '15, 17:17) Kurt Knochner ♦

I am not woking on any assignment, actually i am working on xplico and different protocols it can support so in order to check what all protocols it supports i need pcap files to run against xplico with different scenarios. I found some pcap files but without file attachments so wanted to know how to generate pcap file with file attachments.

(08 Jul '15, 12:21) kruthi

One Answer:

Not sure whether I understand the question correctly. With "generate pcap files" you mean capturing traffic?
And your question is more like
"I want to filter my capture to only contain traffic that contains SMTP,POP3 and IMAP protocol"
The filter on those packets would be: tcp.port==25 or tcp.port==109 or tcp.port==1010
Or is your problem:
"I already captured traffic but I can't find SMTP,POP3 and IMAP protocol in the trace file even though I was sending an e-mail with attachment while the trace was running"
The reason might be that email traffic today is encrypted using TLS so you won't be able to identify the TLS secured e-mail protocols.
Can you please clarify your question, regards Matthias

answered 27 Jun '15, 21:56

mrEEde
3.9k●15●22●70
accept rate: 20%

Actually, if you can obtain the SSL secrets, Wireshark is able to decrypt those captures. See https://wiki.wireshark.org/SampleCaptures#SSL_with_decryption_keys for some examples.

(29 Jun '15, 10:03) Lekensteyn