#275839 doesn't correctly dissect ESMTP pipelining

Package:
tshark
Source:
wireshark
Description:
network traffic analyzer - console version
Submitter:
Marc Haber
Date:
2015-04-09 17:03:49 UTC
Severity:
normal
#275839#5
Date:
2004-10-10 16:14:19 UTC
From:
To:
Hi,

tethereal -V does only show the first command in a packet for a
pipelined ESMTP session.

Here is the output of tcpdump -r file -X for three ethernet frames:
01:51:01.255077 IP smtp.denic.de.41205 >
de46d.ipsec0.torres.ka0.zugschlus.de.sm
tp: P 21:116(95) ack 186 win 8760
        0x0000:  4500 0087 561b 4000 f706 8831 515b a103 E...V.@....1Q[..
        0x0010:  d47e de46 a0f5 0019 c2f6 bee1 c4d3 37de .~.F..........7.
        0x0020:  5018 2238 7af3 0000 4d41 494c 2046 524f P."8z...MAIL.FRO
        0x0030:  4d3a 3c6f 776e 6572 2d70 7562 6c69 632d M:<owner-public-
        0x0040:  6c40 6465 6e69 632e 6465 3e20 5349 5a45 l@denic.de>.SIZE
        0x0050:  3d34 3437 330d 0a52 4350 5420 544f 3a3c =4473..RCPT.TO:<
        0x0060:  6d68 2b64 656e 6963 2d70 7562 6c69 632d mh+denic-public-
        0x0070:  6c40 7a75 6773 6368 6c75 732e 6465 3e0d l@zugschlus.de>.
        0x0080:  0a44 4154 410d 0a                        .DATA..
01:51:01.291539 IP de46d.ipsec0.torres.ka0.zugschlus.de.smtp > smtp.denic.de.412
05: . ack 116 win 32440
        0x0000:  4500 0028 613f 4000 3f06 356d d47e de46 E..(a?@.?.5m.~.F
        0x0010:  515b a103 0019 a0f5 c4d3 37de c2f6 bf40 Q[........7....@
        0x0020:  5010 7eb8 6c00 0000                      P.~.l...
01:51:01.699185 IP de46d.ipsec0.torres.ka0.zugschlus.de.smtp > smtp.denic.de.412
05: P 186:264(78) ack 116 win 32440
        0x0000:  4500 0076 6140 4000 3f06 351e d47e de46 E..va@@.?.5..~.F
        0x0010:  515b a103 0019 a0f5 c4d3 37de c2f6 bf40 Q[........7....@
        0x0020:  5018 7eb8 348e 0000 3235 3020 4f4b 0d0a P.~.4...250.OK..
        0x0030:  3235 3020 4163 6365 7074 6564 0d0a 3335 250.Accepted..35
        0x0040:  3420 456e 7465 7220 6d65 7373 6167 652c 4.Enter.message,
        0x0050:  2065 6e64 696e 6720 7769 7468 2022 2e22 .ending.with."."
        0x0060:  206f 6e20 6120 6c69 6e65 2062 7920 6974 .on.a.line.by.it
        0x0070:  7365 6c66 0d0a                           self..

And now an edited down output of tethereal -r file -V for the same frames:
Internet Protocol, Src Addr: 81.91.161.3 (81.91.161.3), Dst Addr: 212.126.222.70 (212.126.222.70)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
    Total Length: 135
    Identification: 0x561b (22043)
    Flags: 0x04 (Don't Fragment)
    Fragment offset: 0
    Time to live: 247
    Protocol: TCP (0x06)
    Header checksum: 0x8831 (correct)
    Source: 81.91.161.3 (81.91.161.3)
    Destination: 212.126.222.70 (212.126.222.70)
Transmission Control Protocol, Src Port: 41205 (41205), Dst Port: smtp (25), Seq: 21, Ack: 186, Len: 95
    Source port: 41205 (41205)
    Destination port: smtp (25)
    Sequence number: 21    (relative sequence number)
    Next sequence number: 116    (relative sequence number)
    Acknowledgement number: 186    (relative ack number)
    Header length: 20 bytes
    Flags: 0x0018 (PSH, ACK)
    Window size: 8760
    Checksum: 0x7af3 (correct)
    SEQ/ACK analysis
        This is an ACK to the segment in frame: 14
        The RTT to ACK the segment was: 0.012873000 seconds
Simple Mail Transfer Protocol
    Command: MAIL FROM:<owner-public-l@denic.de> SIZE=4473\r\n
        Command: MAIL
        Request parameter: FROM:<owner-public-l@denic.de> SIZE=4473

Frame 16 (54 bytes on wire, 54 bytes captured)
    Arrival Time: Sep 21, 2004 01:51:01.291539000
    Time delta from previous packet: 0.036462000 seconds
    Time since reference or first frame: 26311.400091000 seconds
    Frame Number: 16
    Packet Length: 54 bytes
    Capture Length: 54 bytes
Ethernet II, Src: 00:0b:2b:00:c5:a8, Dst: 00:10:f3:05:1c:71
    Destination: 00:10:f3:05:1c:71 (NexcomIn_05:1c:71)
    Source: 00:0b:2b:00:c5:a8 (Hostnet_00:c5:a8)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 212.126.222.70 (212.126.222.70), Dst Addr: 81.91.161.3 (81.91.161.3)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
    Total Length: 40
    Identification: 0x613f (24895)
    Flags: 0x04 (Don't Fragment)
    Fragment offset: 0
    Time to live: 63
    Protocol: TCP (0x06)
    Header checksum: 0x356d (correct)
    Source: 212.126.222.70 (212.126.222.70)
    Destination: 81.91.161.3 (81.91.161.3)
Transmission Control Protocol, Src Port: smtp (25), Dst Port: 41205 (41205), Seq: 186, Ack: 116, Len: 0
    Source port: smtp (25)
    Destination port: 41205 (41205)
    Sequence number: 186    (relative sequence number)
    Acknowledgement number: 116    (relative ack number)
    Header length: 20 bytes
    Flags: 0x0010 (ACK)
    Window size: 32440
    Checksum: 0x6c00 (correct)
    SEQ/ACK analysis
        This is an ACK to the segment in frame: 15
        The RTT to ACK the segment was: 0.036462000 seconds

Frame 17 (132 bytes on wire, 132 bytes captured)
    Arrival Time: Sep 21, 2004 01:51:01.699185000
    Time delta from previous packet: 0.407646000 seconds
    Time since reference or first frame: 26311.807737000 seconds
    Frame Number: 17
    Packet Length: 132 bytes
    Capture Length: 132 bytes
Ethernet II, Src: 00:0b:2b:00:c5:a8, Dst: 00:10:f3:05:1c:71
    Destination: 00:10:f3:05:1c:71 (NexcomIn_05:1c:71)
    Source: 00:0b:2b:00:c5:a8 (Hostnet_00:c5:a8)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 212.126.222.70 (212.126.222.70), Dst Addr: 81.91.161.3 (81.91.161.3)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
    Total Length: 118
    Identification: 0x6140 (24896)
    Flags: 0x04 (Don't Fragment)
    Fragment offset: 0
    Time to live: 63
    Protocol: TCP (0x06)
    Header checksum: 0x351e (correct)
    Source: 212.126.222.70 (212.126.222.70)
    Destination: 81.91.161.3 (81.91.161.3)
Transmission Control Protocol, Src Port: smtp (25), Dst Port: 41205
(41205), Seq
: 186, Ack: 116, Len: 78
    Source port: smtp (25)
    Destination port: 41205 (41205)
    Sequence number: 186    (relative sequence number)
    Next sequence number: 264    (relative sequence number)
    Acknowledgement number: 116    (relative ack number)
    Header length: 20 bytes
    Flags: 0x0018 (PSH, ACK)
    Window size: 32440
    Checksum: 0x348e (correct)
Simple Mail Transfer Protocol
    Response: 250 OK\r\n
        Response code: 250
        Response parameter: OK

Greetings
Marc
#275839#12
Date:
2008-04-26 08:08:29 UTC
From:
To:
Hi Marc,

could you provide a sample capture file of this?

Thanks, Joost
#275839#17
Date:
2008-04-27 07:44:22 UTC
From:
To:
Yes, even three and a half year after filing this bug it can still be
reproduced by simply dumping any SMTP conversation using PIPELINING to
a file and trying to look at it with tshark and tcpdump respectivlely:

swaks --pipeline --to mh+debian-bugs@zugschlus.de --from mh+debian-bugs@zugschlus.de --timeout 600

for example was used to create the attached file.

Greetings
Marc
#275839#22
Date:
2008-04-27 08:32:07 UTC
From:
To:
Thanks Marc,

the example helped me understand the problem. I'll bring this problem to the
attention of upstream.

Joost