当同时收到大量邮件时，如何跟踪特定邮件的数据包？

Question

smtp协议基本上是这样的：

S: 220 smtp.example.com ESMTP Postfix
C: HELO relay.example.org
S: 250 Hello relay.example.org, I am glad to meet you
C: MAIL FROM:<[email protected]>
S: 250 Ok
C: RCPT TO:<[email protected]>
S: 250 Ok
C: RCPT TO:<[email protected]>
S: 250 Ok
C: DATA
S: 354 End data with <CR><LF>.<CR><LF>
C: From: "Bob Example" <[email protected]>
C: To: "Alice Example" <[email protected]>
C: Cc: [email protected]
C: Date: Tue, 15 Jan 2008 16:02:43 -0500
C: Subject: Test message
C:
C: Hello Alice.
C: This is a test message with 5 header fields and 4 lines in the message body.
C: Your friend,
C: Bob
C: .
S: 250 Ok: queued as 12345
C: QUIT
S: 221 Bye

但是当收到多封邮件时就变得更加复杂

S: 220 smtp.example.com ESMTP Postfix
C: HELO relay.example.org
C: HELO relay.example.org
S: 250 Hello relay.example.org, I am glad to meet you
C: MAIL FROM:<[email protected]>
S: 250 Ok
C: RCPT TO:<[email protected]>
**C2: MAIL FROM:<[email protected]>**
S: 250 Ok
**C2: RCPT TO:<[email protected]>**
C: RCPT TO:<[email protected]>
S: 250 Ok
C: DATA
**C2: DATA2
C3: MAIL FROM:<[email protected]>
C3: RCPT TO:<[email protected]>**
S: 354 End data with <CR><LF>.<CR><LF>
**C3: DATA3**
C: From: "Bob Example" <[email protected]>
C: To: "Alice Example" <[email protected]>
C: Cc: [email protected]
C: Date: Tue, 15 Jan 2008 16:02:43 -0500
C: Subject: Test message
C:
C: Hello Alice.
C: This is a test message with 5 header fields and 4 lines in the message body.
C: Your friend,
C: Bob
C: .
S: 250 Ok: queued as 12345
C: QUIT
S: 221 Bye

那么我如何确定哪个数据包属于C，C1，C2。或者谁正在使用wireshark向[电子邮件受保护]发送邮件？

Answer 1

尝试创建 TCP（tcp.port、tcp.srcport 或 tcp.dstport）或 IP（ip.addr、ip.src 或 ip.dst）过滤器。使用这种过滤器，您应该只能提取一个连接。