X.413 Message Store: Abstract Service (P7)
The P7 protocol allows a mail user agent to send and receive messages through an X.400 message store and the X.400 MTS. It is the X.400 equivalent to the the Internet ["IMAP"] protocol, providing services to manage the messages within the message, rather than having to doawnload them locally.
The P7 message store access protocol was introduced in the X.400(88) version of the standards. It initially provided very limited management facilities, with no support for folders or even storage of submitted messages. These features were gradually introduced in subsequent versions of the standard. However, many P7 user agents still just retrieve the messages and manage them locally, which is more comparable with the ["POP3"] model.
["ROS"]: Typically, P7 uses ["ROS"] during connection establishment (abstract syntaxes [http://oid.elibel.tm.fr/188.8.131.52.1 184.108.40.206.1], [http://oid.elibel.tm.fr/220.127.116.11.5 18.104.22.168.5], [http://oid.elibel.tm.fr/22.214.171.124.9 126.96.36.199.9]).
["ACSE"]: Typically, P7 uses ["ACSE"] for association control (association context [http://oid.elibel.tm.fr/188.8.131.52.11 184.108.40.206.11])
- ["COTP"]: Typically, P7 uses ["COTP"] as its transport protocol. The well known TCP port for P7 traffic is 102, though some Message Stores may listen on a dedicated port.
P7 may also optionally use ["RTSE"].
XXX - Add example decoded traffic for this protocol here (as plain text or Wireshark screenshot).
The P7 dissector is partially functional have currently only implemented the message retrieval and message submission services. The administration services, and support for ["RTSE"] has not yet been included.
There is a single preference field for the P7 dissector, the P7 TCP Port - the port to which P7 associations are made. The default value is 102.
Example capture file
XXX - Add a simple example capture file to the SampleCaptures page and link from here (see below). Keep this file short, it's also a good idea to gzip it to make it even smaller, as Wireshark can open gzipped files automatically.
A complete list of P7display filter fields can be found in the [http://www.wireshark.org/docs/dfref/protofirstletter/proto.html display filter reference]
Show only the P7 based traffic:
You cannot directly filter P7 protocols while capturing. However, if you know the ["TCP"] port used (see above), you can filter on that one.
Capture only the P7 traffic over the non-standard port (103):
tcp port 103
[http://www.itu.int/ITU-T/asn1/database/itu-t/x/x413/1999/MSAbstractService.html ASN.1 Module from ITU]
[http://www.itu.int/rec/T-REC-X.413-199906-I/en X.413 Recommendation]