Differences between revisions 4 and 5
Revision 4 as of 2006-06-05 03:19:30
Size: 2199
Editor: localhost
Comment:
Revision 5 as of 2008-04-12 17:50:30
Size: 2207
Editor: localhost
Comment: converted to 1.6 markup
Deletions are marked like this. Additions are marked like this.
Line 4: Line 4:
The X.420 protocol describes the content of a message that is transferred of an X.400 Message Transfer System. It is one of a number of the defined content types that can be carried over X.400, which includes ["S4406"] and EDI. The X.420 protocol describes the content of a message that is transferred of an X.400 Message Transfer System. It is one of a number of the defined content types that can be carried over X.400, which includes [[S4406]] and EDI.
Line 16: Line 16:
 * ["X411"]: Typically, X.420 uses ["X411"] (P1,P3) as its transport protocol.
 * ["CMS"]: X.420 may also be found the encapsulatedData of a CMS content
 * [[X411]]: Typically, X.420 uses [[X411]] (P1,P3) as its transport protocol.
 * [[CMS]]: X.420 may also be found the encapsulatedData of a CMS content
Line 33: Line 33:
 * attachment:SampleCaptures/p772-transfer-success.pcap (Note this is actually ["S4406"] but S4406 only provides extensions to X.420.)  * [[attachment:SampleCaptures/p772-transfer-success.pcap]] (Note this is actually [[S4406]] but S4406 only provides extensions to X.420.)
Line 36: Line 36:
A complete list of X.420 display filter fields can be found in the [http://www.wireshark.org/docs/dfref/x/x420.html display filter reference] A complete list of X.420 display filter fields can be found in the [[http://www.wireshark.org/docs/dfref/x/x420.html|display filter reference]]
Line 43: Line 43:
You cannot directly filter X.420 protocols while capturing. However, if you know the ["TCP"] port used (see above), you can filter on that one. You cannot directly filter X.420 protocols while capturing. However, if you know the [[TCP]] port used (see above), you can filter on that one.
Line 50: Line 50:
 * [http://www.itu.int/ITU-T/asn1/database/itu-t/x/x420/1999/index.html ASN.1 Specification from ITU]  * [[http://www.itu.int/ITU-T/asn1/database/itu-t/x/x420/1999/index.html|ASN.1 Specification from ITU]]

InterPersonal Messaging System (X.420)

The X.420 protocol describes the content of a message that is transferred of an X.400 Message Transfer System. It is one of a number of the defined content types that can be carried over X.400, which includes S4406 and EDI.

It is equivalent to the IETF Internet Message Format (IMF) and Multipurpose Internet Mail Extensions (MIME).

History

There have been two major versions of the X.420 protocol, one in 1984 and one in 1988. The 1988 version introduced support for X.500 directory names and general purpose extension mechanisms.

The 1984 version of an interpersonal message is identified as "P2", whilst the 1988 and subsequent versions are identified as "P22".

Protocol dependencies

  • X411: Typically, X.420 uses X411 (P1,P3) as its transport protocol.

  • CMS: X.420 may also be found the encapsulatedData of a CMS content

Example traffic

XXX - Add example traffic here (as plain text or Wireshark screenshot).

Wireshark

The X.420 dissector is mostly functional, though some of the heading extensions and extended bodypart types have yet to be supported.

Preference Settings

There are no preference settings specific to X.420 but you might want to enable reassembly of those transport protocols that are used below X.420. Specifically, COTP reassembly.

Example capture file

Display Filter

A complete list of X.420 display filter fields can be found in the display filter reference

  • Show only the X.420 based traffic:

     x420

Capture Filter

You cannot directly filter X.420 protocols while capturing. However, if you know the TCP port used (see above), you can filter on that one.

  • Capture only the X.420 traffic over the default port (102):

     tcp port 102 

Discussion

X420 (last edited 2008-04-12 17:50:30 by localhost)