On Oct 11, 2009, at 2:28 PM, Mike Brandonisio wrote:
Since tshark appears to work I'm trying to record HELOs/EHLOs for a
specific IP, the value of the HELOs/EHLOs.
I have this so far:
tshark -f "port 25" -R "ip.src==74.xx.xx.xx"
I'd try
tshark -f "port 25 and src host 74.xx.xx.xx"
which will do all the filtering in libpcap/the kernel.
However, if the HELO/EHLOs are coming on port 587 rather than port 25,
try
tshark -f "port 587 and src host 74.xx.xx.xx".
I'm assuming here that the HELOs/EHLOs are coming *from* 74.xx.xx.xx;
if not, try
tshark -f "port 587 and dst host 74.xx.xx.xx"
