Hi Folks,

Can anybody help me with setting up wireshark to capture the SMTP session packets from a 7100?

We're having an issue with email gateway. It looks like it is the SMTP session request is getting rejected by the ISP's SMTP server according to the activity log in the DM.

What I'm looking to do, and having no luck with, is capturing the SMTP session request from the 7100.

I've tried using wireshark wide open in promiscuous mode but it doesn't show any traffic when it tries to send the mail.

I can see traffic when using the DM, so I know that it is visible on the network, and the DM activity log shows a response from the SMTP server so I know that the router/firewall isn't getting in the way.

Thanks in advance!

-Will

Try looking at the error log. It lists a little more info when an email fails to send than the activity log does, such as response codes and reasons (failed authentication for example)and may be more helpful without resorting to Wireshark, which may not tell you anything at all.

It gives just a 501 error which apparently is a kind of generic authentication error. That's why I'm hoping to actually see what information is being sent in the session request.

Try typing debug on the port activity screen.
This will make it show lots more information

@nameless,

I cannot seem to find a port activity screen. Are you referring to Wireshark or the DM?

What I really don't get is why there is no visible network activity when the 7100 is trying to send the email.

-W

The port activity screen for the 7100 is accessed via telnet. As far as wiresharking the system I either mirror the switch port if using a managed switch or I carry an old hub if there isn't a managed switch.

I would also recommend using a Mirror switch. Always handy to carry on you.

Thanks all. I ended up putting a second nic in the computer and bridging the two connections in windows. Worked a treat.

Cheers,

I always carry one of these in my bag:

https://dual-comm.com/port-mirroring-LAN_switch.htm

USB powered as well so no need to look for a power outlet, and the PT version passes PoE through too.