smtp协议基本上是这样的:
S: 220 smtp.example.com ESMTP Postfix
C: HELO relay.example.org
S: 250 Hello relay.example.org, I am glad to meet you
C: MAIL FROM:<bob@example.org>
S: 250 Ok
C: RCPT TO:<alice@example.com>
S: 250 Ok
C: RCPT TO:<theboss@example.com>
S: 250 Ok
C: DATA
S: 354 End data with <CR><LF>.<CR><LF>
C: From: "Bob Example" <bob@example.org>
C: To: "Alice Example" <alice@example.com>
C: Cc: theboss@example.com
C: Date: Tue, 15 Jan 2008 16:02:43 -0500
C: Subject: Test message
C:
C: Hello Alice.
C: This is a test message with 5 header fields and 4 lines in the message body.
C: Your friend,
C: Bob
C: .
S: 250 Ok: queued as 12345
C: QUIT
S: 221 Bye
但是当收到多封邮件时,它会变得更加复杂
S: 220 smtp.example.com ESMTP Postfix
C: HELO relay.example.org
C: HELO relay.example.org
S: 250 Hello relay.example.org, I am glad to meet you
C: MAIL FROM:<bob@example.org>
S: 250 Ok
C: RCPT TO:<alice@example.com>
**C2: MAIL FROM:<charliebitme@example.org>**
S: 250 Ok
**C2: RCPT TO:<ouch@example.org>**
C: RCPT TO:<theboss@example.com>
S: 250 Ok
C: DATA
**C2: DATA2
C3: MAIL FROM:<foo@example.org>
C3: RCPT TO:<bar@example.com>**
S: 354 End data with <CR><LF>.<CR><LF>
**C3: DATA3**
C: From: "Bob Example" <bob@example.org>
C: To: "Alice Example" <alice@example.com>
C: Cc: theboss@example.com
C: Date: Tue, 15 Jan 2008 16:02:43 -0500
C: Subject: Test message
C:
C: Hello Alice.
C: This is a test message with 5 header fields and 4 lines in the message body.
C: Your friend,
C: Bob
C: .
S: 250 Ok: queued as 12345
C: QUIT
S: 221 Bye
那么如何确定哪个数据包属于C,C1,C2。或者谁使用wireshark向ouch@example.org发送邮件?
答案 0 :(得分:1)
尝试创建TCP(tcp.port,tcp.srcport或tcp.dstport)或IP(ip.addr,ip.src或ip.dst)过滤器。使用这种过滤器,您应该只能提取一个连接。