当同时收到大量邮件时，如何跟踪特定邮件的数据包？

Question

smtp协议基本上是这样的：

S: 220 smtp.example.com ESMTP Postfix
C: HELO relay.example.org
S: 250 Hello relay.example.org, I am glad to meet you
C: MAIL FROM:<bob@example.org>
S: 250 Ok
C: RCPT TO:<alice@example.com>
S: 250 Ok
C: RCPT TO:<theboss@example.com>
S: 250 Ok
C: DATA
S: 354 End data with <CR><LF>.<CR><LF>
C: From: "Bob Example" <bob@example.org>
C: To: "Alice Example" <alice@example.com>
C: Cc: theboss@example.com
C: Date: Tue, 15 Jan 2008 16:02:43 -0500
C: Subject: Test message
C:
C: Hello Alice.
C: This is a test message with 5 header fields and 4 lines in the message body.
C: Your friend,
C: Bob
C: .
S: 250 Ok: queued as 12345
C: QUIT
S: 221 Bye

但是当收到多封邮件时，事情就变得复杂了。

S: 220 smtp.example.com ESMTP Postfix
C: HELO relay.example.org
C: HELO relay.example.org
S: 250 Hello relay.example.org, I am glad to meet you
C: MAIL FROM:<bob@example.org>
S: 250 Ok
C: RCPT TO:<alice@example.com>
**C2: MAIL FROM:<charliebitme@example.org>**
S: 250 Ok
**C2: RCPT TO:<ouch@example.org>**
C: RCPT TO:<theboss@example.com>
S: 250 Ok
C: DATA
**C2: DATA2
C3: MAIL FROM:<foo@example.org>
C3: RCPT TO:<bar@example.com>**
S: 354 End data with <CR><LF>.<CR><LF>
**C3: DATA3**
C: From: "Bob Example" <bob@example.org>
C: To: "Alice Example" <alice@example.com>
C: Cc: theboss@example.com
C: Date: Tue, 15 Jan 2008 16:02:43 -0500
C: Subject: Test message
C:
C: Hello Alice.
C: This is a test message with 5 header fields and 4 lines in the message body.
C: Your friend,
C: Bob
C: .
S: 250 Ok: queued as 12345
C: QUIT
S: 221 Bye

那么，我如何确定哪个数据包属于C、C1、C2。或者是谁在使用wireshark向ouch@example.org发送邮件？

Answer 1

尝试创建TCP (tcp.port、tcp.srcport或tcp.dstport)或IP (ip.addr、ip.src或ip.dst)筛选器。使用这种过滤器，您应该只能提取一个连接。