This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How can I extract email content from IMF packets using tshark?

0

I'm working on a bash script which can show email text. I can find what I want in an IMF packet:

-> IMF (Internet Message Format)
---> MIME Multipart Media Encapsulation, Type: multipart/alternative, Boundary:
------> Encapsulated multipart part:  (text/plain)
---------> Line-based text data: text/plain
--------------> **** Content to extract is here ****

I only want the text/plain data, but I can't retrieve it. The solution I've found is tshark -i 3 -R data-text-lines -V, but it shows me the entire packet. If I try tshark -i 3 -R "imf || smtp || data-text-lines" -V -T fields -e mime_multipart.part -e data-text-lines in stead, nothing displays --only empty lines. What's going on here, and how can I get only the data I want?

asked 01 Feb '12, 11:38

Cl%C3%A9ment%20Bonnal's gravatar image

Clément Bonnal
1223
accept rate: 0%

edited 01 Feb '12, 12:04

multipleinterfaces's gravatar image

multipleinte...
1.3k152340