Malicious and spam email analysis

In this recipe, we will discuss the use of Wireshark to perform some basic analysis of malicious and spam emails, and use this to filter spam emails on the server itself.

Getting ready

In most cases, spam emails will be sent from outside the domain and targeted at clients within the enterprise. So, it is best to perform packet capture on the server side for analysis.

How to do it...

1. The first step is to identify the data portion of the mail messages. We can use the filter to display the data portion of the mails. The use of email protocol and data will display the packets with data. For example, use pop || data-text-lines to filter the mails with data using the POP3 protocol:

2. In the preceding screenshot, the data exchange between the specific endpoints is not so big. Based on the size, it appears to be a text message and does not carry any attachments, so we can ignore this:

3. On the other hand, the previous capture shows that the data exchange is pretty big and...