Riverbed Cascade Pilot Personal Edition: Take Wireshark to the Next Level - Advanced Triggers and Alerts; Web and VoIP Analytics; Long-Term Trending and Forensics; Deep Packet Analysis with Wireshark

Wireshark-users: Re: [Wireshark-users] Yum install centos 5.2

Date Index Thread Index Other Months All Mailing Lists

Date Prev Date Next Thread Prev Thread Next

From: Mike Brandonisio <mbrando@xxxxxxxxxxxxxx>
Date: Sun, 11 Oct 2009 17:01:42 -0500

Hi, I'm running this: tshark -f "port 25 and src host 74.xx.xx.xx" This is the output I'm getting 0.090293 74.xx.xx.xx -> 64.xx.xx.xx SMTP C: EHLO host22.example.com That is exactly what I'm looking for. How can I can narrow the filter only those that contain 'SMTP'?

Sincerely,
Mike
-- 
Mike Brandonisio          *    Web Hosting / Development
Tech One Illustration     *    Internet Marketing
tel (630) 759-9283 x1001  *    e-Commerce
mbrando@xxxxxxxxxxxxxx    *    www.jikometrix.net

    JIKOmetrix - Reliable web hosting

Guy Harris wrote:

On Oct 11, 2009, at 2:28 PM, Mike Brandonisio wrote:

Since tshark appears to work I'm trying to record HELOs/EHLOs for a  
specific IP, the value of the HELOs/EHLOs.

I have this so far:

tshark -f "port 25" -R "ip.src=""

I'd try

	tshark -f "port 25 and src host 74.xx.xx.xx"

which will do all the filtering in libpcap/the kernel.

However, if the HELO/EHLOs are coming on port 587 rather than port 25,  
try

	tshark -f "port 587 and src host 74.xx.xx.xx".

I'm assuming here that the HELOs/EHLOs are coming *from* 74.xx.xx.xx;  
if not, try

	tshark -f "port 587 and dst host 74.xx.xx.xx"
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

begin:vcard
fn:Mike Brandonisio
n:Brandonisio;Mike
org:Tech One Illustration
adr:;;231 S. Cranberry St.;Bolingbrok;Illinois;60490;US
email;internet:mbrando@xxxxxxxxxxxxxx
title:Principal
tel;work:630-759-9283 x1001
tel;fax:630-214-9877
x-mozilla-html:FALSE
url:http://www.jikometrix.net
version:2.1
end:vcard

Follow-Ups:
- Re: [Wireshark-users] Yum install centos 5.2
  - From: Guy Harris

References:
- [Wireshark-users] Yum install centos 5.2
  - From: Mike Brandonisio
- Re: [Wireshark-users] Yum install centos 5.2
  - From: Guy Harris
- Re: [Wireshark-users] Yum install centos 5.2
  - From: Mike Brandonisio
- Re: [Wireshark-users] Yum install centos 5.2
  - From: Guy Harris
- Re: [Wireshark-users] Yum install centos 5.2
  - From: Mike Brandonisio
- Re: [Wireshark-users] Yum install centos 5.2
  - From: Guy Harris

Prev by Date: Re: [Wireshark-users] Yum install centos 5.2
Next by Date: [Wireshark-users] promiscuous capture on Mac OS X shows different 802.11 rates
Previous by thread: Re: [Wireshark-users] Yum install centos 5.2
Next by thread: Re: [Wireshark-users] Yum install centos 5.2
Index(es):
- Date
- Thread