2

I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP.
I would also like to use Wireshark to show the contents of the SMTP message to see if it is what I sent.

I cannot figure out, nor find help, on just simply making Wireshark show only SMTP. Wireshark doc says to set filter to SMTP, but that does not work for me.

Improve this question
2
  • 2
    Are you sure it is using SMTP and not SMTPS? Most SMTP traffic is now utilizing SMTPS since it is encrypted. With SMARTTLS, SMTPS can use port TCP/25, but check on ports TCP/587 or possibly TCP/465 for SMTPS traffic.
    – YLearn
    May 5, 2017 at 17:54
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Feb 19, 2018 at 3:59

1 Answer 1

Reset to default
2

Filtering while capturing data in Wireshark is documented here: https://wiki.wireshark.org/CaptureFilters

An example of such for SMTP is: tcp port smtp

Filtering already captured data is here: https://www.wireshark.org/docs/wsug_html_chunked/ChWorkDisplayFilterSection.html

An example of such for SMTP is: tcp.port == 25 or simply smtp

When configuring display filters, you have to make sure to press enter or click Apply

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.