Microsoft Message Analyzer decode NDIS ETW Provider Field data - wireshark

How to decode Microsoft Message Analyzer NDIS ETW Provider Field data?
This is my own local communication soft which send commands to my DB server, there are not using any encryptions, but why message is steal encoding?

Related

MQTT publisher of message

I'm trying to run an MQTT broker and I want to store the published data, but I need to know which user sent the message so I can store payload for each user and study them later. The problem is when two different user try to publish message on same topic I can not tell whose data it is. Is there a way to figure out the publisher of a message? I'm using Mosquitto btw.
Short answer, you don't.
MQTT messages do not contain any information about the user or client that sent it, unless you choose to encode it in the message (as part of the payload for v3.x or alternatively in the header properties for v5.0)
Longer answer:
Some MQTT brokers have plugin APIs that may allow you access to more meta data for a message. You may be able to write a plugin that will take the message + the meta data and then store them. Last time I looked, mosquitto's plugin API was only for writing authentication plugins, and did not give access to the messages themselves. But a different broker may allow this.

Using IdHTTP to send array of bytes to a PHP

I am trying to build a simple client - server - client application using the IdHTTP component.
How to use IdHttp component to send array of bytes from a client1 to a php file located on www.example.com and have this php file send the same data to be consumed by a client2 using the IdHTTp? Maybe I am taking the wrong path here.
For sending the data from client1 to the server I recommend to use Base64 encoding. This way you have a normal string instead of a byte array. Sending strings with IdHTTP is simple. An alternative is multipart form data (Java code here).
For receiving the data on client2: HTTP clients do not know when there is data on the server. Asynchronous receive (server push) is a feature of the new WebSocket protocol, which is an extension of HTTP so it needs specifix extensions on the client and server side. There are open source and commercial implementations of the WebSocket protocol for Delphi.
If your client2 is a normal HTTP client, it has no option than to continuously poll data from the server. For basic use cases, I would recommend a TIdTCPClient component instead of TidHTTP which gives you more control over the processing of incoming data. The client jst needs to open a socket connection on port 80 of the server, send a well-formed HTTP request and then run a loop to receive the response. When the server has new data, the PHP script will start to send data (maybe even without HTTP response headers) and then the Base64 encoded data.

What do the SMTP Indy component security and authentication properties do?

I am using the indy components to implement emails in a delphi application. I am specifically using the TidSMTP component. I need to effectively support all major email servers. I use Mozilla Thunderbird as my email client and am comparing the smtp properties with those in the TidSMTP component. I have attempted to find documentation that describes the relationship between the TidSMTP properties, but have not been able to figure it out.
Can someone explain how these compare and what they do:
In Thunderbird:Connection Security: (None, STARTTLS, SSL/TLS).
In TidSMTP.UseTLS (utNoTLSSupport, utUseImplicitTLS, utUseRequireTLS, utUseExplicitTLS)
In Thunderbird:Authentication method: (No Authentication, Normal Password, Encrypted Password, Kerberos/GSSAPI, NTLM)
In TidSMTP (username, password, with useAuthentication method)
I also see other TidSMTP properties: UseEhlo, UseVerp, UseNagle. Do I need to be using these? What do they do?
When using STARTTLS, the server's listening port is initially unencrypted upon connecting. When a client connects, it can send an optional STARTTLS command to the server, if the server supports it, to dynamically perform the SSL/TLS handshake at that time. This allows legacy non-SSL/TLS clients to continue connecting to that same port, while allowing newer SSL/TLS-enabled clients to use SSL/TLS if available on the server. This corresponds to UseTLS=utUseExplicitTLS in Indy. You need to set UseEHLO to True in order to use UseTLS=utUseExplicitTLS, as the EHLO command is how TIdSMTP discovers whether the server supports the STARTTLS command or not.
When using SSL/TLS instead of STARTTLS, the server's listening port is always using encryption and the client must initiate the SSL/TLS handshake immediately upon connecting before any other data can be exchanged. This corresponds to UseTLS=utUseImplicitTLS in Indy. There is no STARTTLS command used.
For authentication, TIdSMTP has two options - the old (and unsecure) AUTH LOGIN command that is defined by the original SMTP spec, and SMTP extensions for SASL-based hashing/encryption algorithms (Kerberos, GSSAPI, NTLM, etc are implemented as SASL algorithms).
To use SASL, set TIdSMTP.AuthType to satSASL and then fill in the TIdSMTP.SASLMechanisms collection to point at separate TIdSASL-derived components for the algorithms you want to support in your app. Indy has native SASL components for DIGEST-MD5, CRAM-MD5, CRAM-SHA1, NTLM (experimental), ANONYMOUS, EXTERNAL, OTP, PLAIN, SKEY, and LOGIN (SASL wrapper for AUTH LOGIN). If you need another algorithm (Kerberos or GSSAPI, for instance), you will have to write your own TIdSASL-derived component. For algorithms that use Username/Password, the values must be assigned to a separate TIdUserPassProvider component that is then assigned to the SASL components (the TIdSMTP.UserName and TIdSMTP.Password properties are not used with SASL). The more SASL algorithms you support, the wider the number of servers you will be able to support.
For servers that still support AUTH LOGIN, it can be used either by setting TIdSMTP.AuthType to satDefault (and optionally setting TIdSMTP.ValidateAuthLoginCapability to False if the server supports AUTH LOGIN but does not report it in response to the EHLO command) and then filling in the TIdSMTP.UserName and TIdSMTP.Password properties, or by including the TIdSASLLogin component in the TIdSMTP.SASLMechanisms collection.
UseVerp and UseNagle have nothing to do with security. VERP is an SMTP extension for detecting bouncing emails due to undeliverable errors. Nagle is a networking algorithm for optimizing network data packets.

Oracle error occurred, but error message could not be retrieved from Oracle

There is a delphi application in which I am trying to connect to Oracle database Using provider MSDAORA.1 but problem is coming in connecting. Oracle error message which is coming is "Oracle error occurred, but error message could not be retrieved from Oracle"
I am able to connect to database with Oracle10g client.
Connection String: Provider=MSDAORA.1;
User ID=murat;
Password = murat;
Data Source=(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp) (HOST= INGPSP)(PORT=1521))(CONNECT_DATA=(SID=INGPSP)));
Persist Security Info=False;
Please provide your expert opinion what can be the reason of this?
The service name seems to be lacking in your address.
Set a tnsnames.ora file, and use the entry as data source instead of the data_source parameter you set. Follow the steps available on the faq.
Or use use connection strings like '//host[:port]/[service_name]' for your data source: //INGPSP:1521/ServiceName
For Oracle, both Microsoft and Oracle OleDB providers are known to have issue with BLOBs. If you can, use another mean of connection.
What I see that is strange is that your HOST and SID are the same. The HOST is the name of the machine on your network and the SID is the database instance on that machine. I created the following ConnectionString for the PRD3 database on machine DB19 (there are multiple databases on DB19) on our network. I was able to connect to the database successfully with real User ID and Password.
Provider=MSDAORA.1;
Password=123456;
User ID=abc;
Data Source="(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=db19)(PORT=1521))(CONNECT_DATA=(SID=prd3)))";
Persist Security Info=True
Normally the Data Source I use is the database name as defined in TNSNAMES.ORA. It is a lot less to type (fewer potential errors) and can be changed to another database without recompiling the program (such as switching between a development database and production database).

imap - how to validate that complete message was transferred?

Does IMAP protocol provide any way to validate / verify that complete message was transferred from the server to local client? i.e. is there any equivalent of ETag / MD5 or some other checksum?
The IMAP protocol will tell you how many octets are going to be transfered when you issue the FETCH command. This should enable you to verify the completeness of the message. However, there is no command (AFAIK) that would provide any kind of checksum/hash functionality.

Resources