Re: learning sniffer skills

[Alexander Klimov <alserkli () inbox ru>]

On Thu, 9 Dec 2004, Carlos Mario Mora (c4y0) wrote:
> Im starting to learn use a sniffer, but now im stopped with the method
> to read the sniffer output.
>
> Im trying read with tcpdump or snort the mail messages downloaded by
> pop3.  But can see the message content.    How can "assembly" the
> message readed with the sniffer?

It is quite possible to make sense of content using -X in tcpdump:
  -X     Print each packet (minus its link level header) in hex and  ASCII.
         This  is very handy for analysing new protocols.
also note
  -s     Snarf snaplen bytes of data from each packet rather than the
         default of 68...
-- 
Regards,
ASK