Re: Yum install centos 5.2

[Mike Brandonisio <mbrando () jikometrix net>]

Hi Guy,

I was thinking about this again. While I'll be able to see what is going 
on with the IP address via SMTP I also need a time stamp in server time 
and if possible what executed the command that made the SMTP outbound 
connection.

Not that I think tshark should do all of the this. I'm wonder how to or 
what else to add to the mix to get good intel on what is getting me 
listed on CBL.

Sincerely,
Mike
--
Mike Brandonisio          *    Web Hosting / Development
Tech One Illustration     *    Internet Marketing
tel (630) 759-9283 x1001  *    e-Commerce
mbrando () jikometrix net    *    www.jikometrix.net

   JIKOmetrix - Reliable web hosting



Guy Harris wrote:
> On Oct 11, 2009, at 3:07 PM, Mike Brandonisio wrote:
>
>   
> > I'm seeing what looks like encoded traffic.
> >
> > \027\003\001\000
> >
> > Any thoughts on how it is encoded?
> >     
>
> Is this on port 25?  If so, it *might* be SMTP-over-TLS:
>
>         http://tools.ietf.org/html/rfc2487
>
> although I think newer versions of Wireshark/TShark should recognize  
> the STARTTLS command and dissect traffic following it as TLS.
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org?subject=unsubscribe
>
>

Attachment: mbrando.vcf
Description:

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe