Skip to content

Support STARTTLS for NNTP

Description

At the moment, the NNTP dissector lacks support for STARTTLS.

This makes it difficult to inspect opportunistically-encrypted NNTP traffic, or NNTP traffic to hosts that don't implement implicit TLS for NNTP. (For example, it doesn't look like news.gmane.io does.)

Links / references / protocol specifications

RFC 4642 Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP). Specifically, Section 2.2. STARTTLS Command.

As updated by:

RFC 8143 Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP).

(Not sure if the updates matter from Wireshark's PoV, though, since Wireshark can't exactly reject invalid operations anyway. I suppose it could detect when things aren't done correctly, but that's far beyond what I'm hoping for!)

Sample capture

Here's a capture with embedded secrets for the beginning of a session: NNTP-with-STARTTLS-dsb.pcapng

enhancement

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information