Mail Packet Capture
Mail traffic capture & basic analysis
Choose mail traffic to capture, generate a Linux tcpdump command, and learn to read the terminal output or a PCAP file. Nothing runs in this page.
Capture workflow & scope
Choose traffic → set ports/interface/server → generate a command → run on Linux → inspect summaries or open a PCAP → choose the next diagnostic tool. This page guides basic analysis; it does not capture or parse packet files.
Processed locally. No input is uploaded or stored.
Scope
Generated text only. Nothing is executed or connected from this page.
Capture may need administrator/capture privileges. Run on a system you administer; sudo is not added automatically. Stops after 100 packets or Ctrl+C. PCAP may contain sensitive mail data; handle it accordingly.
Result
How to run the command
- Open a terminal on the Linux system where the traffic occurs. tcpdump must be installed.
- Run the generated command. Some systems require administrator or capture privileges.
- Perform the SMTP/IMAP action you want to inspect.
- Read terminal summaries or wait for packets to be saved to the PCAP file.
- Press Ctrl+C to stop. The command also stops after 100 packets (-c 100).
-i chooses the interface; -nn keeps addresses and ports numeric. Only traffic visible at the capture point can be inspected. If nothing appears, check the interface, filter and whether test traffic actually ran.
Open the saved PCAP
-w mail-capture.pcap writes packet data instead of terminal summaries. -s 0 uses tcpdump’s default snapshot length. The file is saved in the terminal’s current directory; reusing the filename overwrites it. Stop capture before opening it.
In Wireshark, use File → Open → mail-capture.pcap, then paste this into the display filter bar. This changes what is shown, not what was captured.
Individual port filters
tcp.port == 25 tcp.port == 465 tcp.port == 587 tcp.port == 143 tcp.port == 993
smtp / imap filters are useful only when Wireshark recognizes those protocols. They may miss TLS traffic or custom ports; start with tcp.port.
Wireshark TCP display filter referenceSSL/TLS (465/993), or SMTP/IMAP after STARTTLS, hides mail commands and bodies. Capture still helps inspect endpoints, TCP setup, replies, resets, data exchange and shutdown timing.
Read a tcpdump line & TCP flags
192.168.0.10.50000 > 203.0.113.10.587: Flags [S]
Here, 192.168.0.10:50000 is the client requesting a connection, and 203.0.113.10:587 is the SMTP server. > means left-to-right transmission. Server replies reverse these endpoints.
Flags [S]- SYN: requests a TCP connection
Flags [S.]- SYN/ACK: responds to a connection request
Flags [.]- ACK: acknowledges received data
Flags [P.]- PSH/ACK: often seen with application data; inspect length as well
Flags [F.]- FIN/ACK: connection shutdown
Flags [R]- RST: connection reset (may also appear as [R.])
One flag does not establish a root cause. Compare both directions and timestamps. Repeated SYN without a reply suggests checking routing, filters and the server, but is not a verdict.
Plaintext SMTP flow
This terminal mode shows packet summaries, not mail payload. For a plaintext connection, save a PCAP and inspect the reconstructed conversation in Wireshark (Follow → TCP Stream).
TCP → EHLO → 250 → MAIL FROM → RCPT TO → DATA → 354 → message data → . → 250 → QUIT
- EHLO
- Identifies the client and asks for server capabilities
- 250
- Successful completion of the requested action
- MAIL FROM / RCPT TO
- Envelope sender / recipient
- DATA
- Requests transfer of headers and body; wait for 354
- QUIT
- Ends the SMTP session
Why is mail content invisible? TLS & STARTTLS
465/993 use TLS immediately. On 587/143, STARTTLS can initially expose SMTP EHLO or IMAP CAPABILITY, then a TLS handshake and encrypted commands/data. A port number alone does not prove encryption; check the actual exchange.
Initial plaintext capabilities → STARTTLS → TLS handshake → encrypted SMTP/IMAP
Wireshark can identify a TLS handshake when captured and recognized. Packet summaries or a handshake alone do not verify certificates or prove successful mail delivery; use OpenSSL or protocol replies for those checks.