Ethereal/Wireshark dissector for XMPP?

Openfire Openfire Support
1

I’'ve been trying to use Ethereal and/or Wireshark to watch XMPP traffic while building a Spark based application. Unfortunately, the “Jabber” dissector recognizes the chat traffic but produces less than useful output(e.g.
200L\001\003\001…).

Does anyone know how to get Ethereal/Wireshark to display an ASCII view of the XMPP XML?

Thanks,

Dan

2

Hey Dan,

Is your client using encrypted connections (i.e. TLS/SSL)? From the admin console of Wildfire you will see a lock next to the session in the session summary page. For your test try using a non-encrypted connection so you can see the XML traffic.

Attached you will find a Wildfire’'s plugin that will print received and sent packets to the stdout. Just copy the .jar file in the plugins folder and way around 30 seconds for Wildfire to load it. That would be another way of seeing Presence, Message and IQ packets.

Regards,

– Gato

3

Bingo- it is indeed SSL. Odd, though, since the admin shows 5269 and 5222 as NORMAL with 5223 as SSL, but I see all the traffic flowing on 5222. Any idea why it’'s SSL on 5222?

How does one configure Spark for SSL or non-SSL?

Thanks,

Dan

4

Hey Dan,

We are about to improve the description on ports. Port 5222 is the standard XMPP port where clients connect. Over that port you can have encrypted or unencrypted connections. XMPP supports StartTLS which unlike the old SSL method used in port 5223 does not start connections using encryption. Clients initially connect to the server using an unencrypted connection and almost at the beginning they request the server to start using TLS to encrypt the communication. Port 5223 starts using encryption right from the beginning.

From the admin console you can specify if TLS is always required, it is optional or if it’'s disabled.

Regards,

– Gato

5

Got it- that answers my question. Thanks for the quick response and great product!

Cheers,

Dan

6

BTW, I installed the debugger.jar in wildfire, but I don’‘t see where it’‘s writing the packets to… where is stdout pointing? I looked through the configs and didn’'t see anything…