Wireshark/SMTP

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze Simple Mail Transfer Protocol (SMTP) traffic.

Readings

Wikipedia: Simple Mail Transfer Protocol

Preparation

To prepare for this activity:

Start Windows.
Log in if necessary.
Install Wireshark.
Install the Telnet client.

Activity 1 - Capture SMTP Traffic

To capture SMTP traffic:

Start a Wireshark capture.
Open a command prompt.
Type telnet gmail-smtp-in.l.google.com 25 and press Enter. If this does not work, your ISP may be blocking outbound traffic on port 25. You can try telnet smtp.gmail.com 587 instead to generate SMTP traffic and then filter on port 587 in the next activity.
Observe the server response.
Type helo and press Enter.
Observe the server response. Note that at this point you could enter mail, rcpt and data to send an SMTP message, but this only works on servers configured to allow clear text relay without authentication.
Type quit and press Enter to close the connection.
Observe the server response.
Close the command prompt.
Stop the Wireshark capture.

Activity 2 - Select Destination Traffic

To select destination traffic:

Observe the traffic captured in the top Wireshark packet list pane. To view only SMTP traffic, type smtp (lower case) in the Filter box and press Enter.
Select the first SMTP packet labeled 220 ....
Observe the destination IP address.
To view all related traffic for this connection, change the filter to ip.addr == <destination>, where <destination> is the destination address of the SMTP packet.

Activity 3 - Analyze TCP Connection Traffic

To analyze TCP connection traffic:

Observe the traffic captured in the top Wireshark packet list pane. The first three packets (TCP SYN, TCP SYN/ACK, TCP ACK) are the TCP three way handshake. Select the first packet.
Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / Transmission Control Protocol frame.
Expand Ethernet II to view Ethernet details.
Observe the Destination and Source fields. The destination should be your default gateway's MAC address and the source should be your MAC address. You can use ipconfig /all and arp -a to confirm.
Expand Internet Protocol Version 4 to view IP details.
Observe the Source address. Notice that the source address is your IP address.
Observe the Destination address. Notice that the destination address is the IP address of the SMTP server.
Expand Transmission Control Protocol to view TCP details.
Observe the Source port. Notice that it is a dynamic port selected for this HTTP connection.
Observe the Destination port. Notice that it is smtp (25). Note that all of the packets for this connection will have matching MAC addresses, IP addresses, and port numbers.

Activity 4 - Analyze SMTP Service Ready Traffic

To analyze SMTP Service Ready traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the fourth packet, which is the first SMTP packet and labeled 220 ....
Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / Transmission Control Protocol / Hypertext Transfer Protocol frame. Also notice that the Ethernet II, Internet Protocol Version 4, and Transmission Control Protocol values are consistent with the TCP connection analyzed in Activity 3.
Expand Simple Mail Transfer Protocol and Response to view SMTP details.
Observe the Response code and Response parameter.
Observe the traffic captured in the top Wireshark packet list pane.
Select the fifth packet, labeled TCP ACK. This is the client TCP acknowledgement of receiving the Service Ready message.

Activity 5 - Analyze SMTP HELO Traffic

To analyze SMTP HELO traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the following TCP segments and acknowledgements. If you observe the packet details in the bottom Wireshark packet bytes pane carefully, you will see that the segments spell out the helo message. The sequence ends with a Wireshark-combined SMTP client helo message, followed by a server TCP acknowledgement.

Activity 6 - Analyze SMTP Completed Traffic

To analyze SMTP Completed traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the following SMTP packet, labeled 250 ...
Observe the packet details in the middle Wireshark packet details pane.
Expand Simple Mail Transfer Protocol and Response to view SMTP details.
Observe the Response code and Response parameter.

Activity 7 - Analyze SMTP QUIT Traffic

To analyze SMTP QUIT traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the following TCP segments and acknowledgements. If you observe the packet details in the bottom Wireshark packet bytes pane carefully, you will see that the segments spell out the quit message. The sequence ends with a Wireshark-combined SMTP client quit message, followed by a server TCP acknowledgement.

Activity 8 - Analyze SMTP Closing Traffic

To analyze SMTP Closing traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the following SMTP packet, labeled 221 ...
Observe the packet details in the middle Wireshark packet details pane.
Expand Simple Mail Transfer Protocol and Response to view SMTP details.
Observe the Response code and Response parameter.
Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.

References