Search Results

XMPP Packet Captures

XMPP is the Extensible Messaging and Presence Protocol. It is used in a variety of technologies including instant messaging, WebRTC and in IoT devices. Here is a collection of captures to show the low level packets that clients and servers use to provide messaging and presence with XMPP.


Adium is a free instant messaging application for macOS that can connect to an XMPP server as well as a variety of others.

  • Adium Version:
  • IP:

Add Account

Connect Account

Connect Account Incorrect Password

Disconnect Account

Add Contact

Send Message

Create Chatroom

Set Nickname

Set Password

Set vCard


Ping Hostname


Blather is a Ruby Library and DSL for XMPP. These captures were taken using the examples provided with the rubygem.

  • Blather Version: 1.2.0
  • IP:


Had to modify this example a bit to make sure the message wasn’t coming from our Blather bot. Otherwise, once it echoed a message from a user it would keep echoing it’s own message back!






Default Setup

The ejabberd was used as the XMPP server in these captures. TLS was disabled to capture this network traffic so that we could show the packets without encryption but this should never be disabled in production!

ejabberd XMPP server

  • Operating System: CentOS Linux release 7.0.1406 (Core)
  • ejabberd Version: 17.07-linux-x86_64
  • Virtual Hostname: cs-xmpp.lan
  • IP: