======== smtp.log ======== In the section discussing the :file:`http.log`, we noted that most HTTP traffic is now encrypted and transmitted as HTTPS. We face a similar situation with Simple Mail Transfer Protocol (SMTP). For a protocol with “simple” in its name, modern instantiations of SMTP are surprisingly complex. For the purpose of this article, it’s sufficient to recognize that a mail user agent (MUA) seeking to submit email via SMTP will contact a mail submission agent (MSA). Modern implementations will use ports 587 or 465 TCP, which is encrypted using TLS. Unencrypted implementations will use port 25 TCP. Because SMTP traffic on ports 587 or 465 TCP is encrypted, we will not see individual emails when observing traffic using those protocols. This section will demonstrate how Zeek reports on email traffic using ports 25, 465, and 587 TCP. Remember that to see the meaning of each field in the :file:`smtp.log`, check :zeek:see:`SMTP::Info`. Inspecting SMTP Traffic ======================= The following is a capture of an SMTP session retrieved from an online packet capture database. I have reconstructed the session using :program:`tcpflow` and edited it to remove material not necessary to make my point. .. literal-emph:: SMTP server: 220-xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail. SMTP client: **EHLO GP** SMTP server: 250-xc90.websitewelcome.com Hello GP [122.162.143.157] 250-SIZE 52428800 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP SMTP client: **AUTH LOGIN** SMTP server: 334 VXNlcm5hbWU6 SMTP client: **Z3VycGFydGFwQHBhdHJpb3RzLmlu** SMTP server: 334 UGFzc3dvcmQ6 SMTP client: **cHVuamFiQDEyMw==** SMTP server: 235 Authentication succeeded SMTP client: **MAIL FROM: ** SMTP server: 250 OK SMTP client: **RCPT TO: ** SMTP server: 250 Accepted SMTP client: **DATA** SMTP server: 354 Enter message, ending with "." on a line by itself SMTP client: **From: "Gurpartap Singh" ** **To: ** **Subject: SMTP** **Date: Mon, 5 Oct 2009 11:36:07 +0530** **Message-ID: <000301ca4581$ef9e57f0$cedb07d0$@in>** **MIME-Version: 1.0** **Content-Type: multipart/mixed;** **.boundary="----=_NextPart_000_0004_01CA45B0.095693F0"** **X-Mailer: Microsoft Office Outlook 12.0** **Thread-Index: AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==** **Content-Language: en-us** **x-cr-hashedpuzzle: SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA=** **x-cr-puzzleid: {CAA37F59-1850-45C7-8540-AA27696B5398}** **This is a multipart message in MIME format.** **------=_NextPart_000_0004_01CA45B0.095693F0** **Content-Type: multipart/alternative;** **.boundary="----=_NextPart_001_0005_01CA45B0.095693F0"** **------=_NextPart_001_0005_01CA45B0.095693F0** **Content-Type: text/plain;** **.charset="us-ascii"** **Content-Transfer-Encoding: 7bit** **Hello** **I send u smtp pcap file** **Find the attachment** **GPS** **------=_NextPart_001_0005_01CA45B0.095693F0** **Content-Type: text/html;** **.charset="us-ascii"** **Content-Transfer-Encoding: quoted-printable** **** **** **** **** **