Hi,
I'm running this:
tshark -f "port 25 and src host 74.xx.xx.xx"
This is the output I'm getting
0.090293 74.xx.xx.xx -> 64.xx.xx.xx SMTP C: EHLO
host22.example.com
That is exactly what I'm looking for.
How can I can narrow the filter only those that contain 'SMTP'?
Sincerely,
Mike
--
Mike Brandonisio * Web Hosting / Development
Tech One Illustration * Internet Marketing
tel (630) 759-9283 x1001 * e-Commerce
mbrando@xxxxxxxxxxxxxx * www.jikometrix.net
JIKOmetrix - Reliable web hosting
Guy Harris wrote:
On Oct 11, 2009, at 2:28 PM, Mike Brandonisio wrote:
Since tshark appears to work I'm trying to record HELOs/EHLOs for a
specific IP, the value of the HELOs/EHLOs.
I have this so far:
tshark -f "port 25" -R "ip.src=""
I'd try
tshark -f "port 25 and src host 74.xx.xx.xx"
which will do all the filtering in libpcap/the kernel.
However, if the HELO/EHLOs are coming on port 587 rather than port 25,
try
tshark -f "port 587 and src host 74.xx.xx.xx".
I'm assuming here that the HELOs/EHLOs are coming *from* 74.xx.xx.xx;
if not, try
tshark -f "port 587 and dst host 74.xx.xx.xx"
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
|
begin:vcard
fn:Mike Brandonisio
n:Brandonisio;Mike
org:Tech One Illustration
adr:;;231 S. Cranberry St.;Bolingbrok;Illinois;60490;US
email;internet:mbrando@xxxxxxxxxxxxxx
title:Principal
tel;work:630-759-9283 x1001
tel;fax:630-214-9877
x-mozilla-html:FALSE
url:http://www.jikometrix.net
version:2.1
end:vcard
