On Oct 11, 2009, at 3:01 PM, Mike Brandonisio wrote:
This is the output I'm getting
0.090293 74.xx.xx.xx -> 64.xx.xx.xx SMTP C: EHLO host22.example.com
That is exactly what I'm looking for.
How can I can narrow the filter only those that contain 'SMTP'?
"Contain 'SMTP'" in what sense? Port 25 traffic normally "contains
SMTP" in the sense that the traffic going to or from TCP port 25 is
almost always SMTP traffic (nothing absolutely *prevents* non-SMTP
traffic to be sent on port 25, but it's not usually done.
Or do you mean "only those that contain 'HELO' or 'EHLO'"? That's
trickier, but it should be possible, even with a capture filter - you
want TCP segments where the payload begins with "HELO" or "EHLO".
If there are no TCP options, then
tcp[20:4] = 0x48454c4f or tcp[20:4] = 0x45484c4f
will match all segments beginning with HELO or EHLO, so
tcp port 25 and src host 74.xx.xx.xx and (tcp[20:4] = 0x48454c4f or
tcp[20:4] = 0x45484c4f)
should work as a capture filter. If there are TCP options, it'd be a
little more complicated, as "20" would have to be replaced by the
length of the TCP header (it can be done, I'd just have to spend some
more time figuring it out).
One of these days I may look at adding some libpcap syntax to do
string matching and matching on TCP/UDP payload contents.
