0
I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP. I would also like to use Wireshark to show the contents of the SMTP message to see if it is what I sent.
I cannot figure out, nor find help, on just simply making Wireshark show only SMTP. Wireshark doc says to set filter to SMTP, but that does not work for me.
Are you running the packet capture on the same machine (AzureVM) that you are receiving SMTP on? If not, you will only see broadcasts and multicasts if you are capturing packets unless you have some way to turn on port mirroring or SPAN – Richie086 – 2017-05-05T18:41:09.760
there are to way one would be to just capture the whole traffic and then filter it to smtp protocol but since all the traffic is captured this may generate huge files so if you only interested in smtp it would be more usefull to work with a capture filter https://wiki.wireshark.org/CaptureFilters if you wanna know what exactly is the difference take a look here https://ask.wireshark.org/questions/6660/what-is-the-difference-between-capture-filter-and-display-filter - since you're working with VM make shure you capture on the Virtual VM-Interface not on the Real Networkcard
– konqui – 2017-05-06T06:54:07.373Yes, running Wireshark on the Azure VM Windows server that is receiving SMTP email. – Doug Null – 2017-05-07T03:35:23.823