Email or SMTP

[lovejotd]

I am looking for a way to process email or smtp data from a pcap file, has anyone done this before? Do you have any insight? Thanks!

[dgelessus]

Hi! Both email messages and SMTP are text-based formats/protocols, which are not really the main focus of Kaitai Struct. Text formats often have a free-form structure that requires lookahead or backtracking during parsing, whereas Kaitai Struct is intended for formats with a fixed structure that can be parsed unambiguously. Although some text formats can be parsed using Kaitai Struct, in many cases it doesn't work very well (or at all). You could try writing KSYs for SMTP and email, but it would probably be easier to use an existing email handling library for your programming language.

We have KSYs for pcap files, IPv4, IPv6, and TCP, which you could use to extract the raw SMTP communication from a pcap file - but that would require a lot of manual work, because you would have to find the relevant packets in the pcap file, reassemble TCP segments, etc. Again, there are probably other tools and libraries that can do that with much less manual work than using Kaitai Struct. (I can't recommend any particular tool/library, sorry - I don't work with network captures very often.)

[KOLANICH]

@lovejotd, also feel free to repurpose https://github.com/KOLANICH-tools/USBPcapOdinDumper for your needs. When I need to unpack something from pcap, I usually clone that repo and edit slightly.