Before sending the email, the user would also have to authenticate to the server, which can leak credentials in plaintext. This email sample includes two valid email addresses plus any sensitive data included in the text of the email. The image above also demonstrates the risk of using SMTP in plaintext with TLS encryption. This sample includes setting the sender’s and recipient’s email addresses and the text of the message. Each field in a standard email requires a separate pair of commands and responses. It shows the beginning stages of creating an email in SMTP.Īs shown, sending emails in SMTP is a drawn-out process. The image above is a sample of SMTP traffic that is collected in Wireshark using the Follow TCP Stream option. This consists of a response code, in this case 250, and optional parameters. The image above shows a standard SMTP response. In this case, the user is setting the sender’s email address. As shown in the image above, an SMTP request consists of a command followed by a set of optional parameters. This is accomplished using a request-response structure. SMTP is a text-based protocol designed to be limited to printable ASCII characters. Alternatively, users can filter for ports commonly used in SMTP traffic (i.e., 25, 587 and 465).

SMTP traffic can be filtered in Wireshark using the built-in smtp filter. For example, a Google mail server can be reached by using Telnet to connect to gmail-smtp-in.l. on port 25.

Google and other services maintain SMTP mail servers, allowing users to interact with them programmatically. Whether you use an email server hosted on-premises or a webmail service like Gmail or O365, there is a decent chance that SMTP is being used somewhere behind the scenes. However, port 465 was historically used for encrypted SMTP and some implementations use this.

The officially accepted way to use TLS with SMTP is to use port 25 and send a STARTTLS message to indicate the beginning of TLS usage. As a result, SMTP traffic can be encrypted using Transport Layer Security (TLS). However, using traffic that is easily readable by eavesdroppers is not a good idea for email.

Wireshark commands