Capturing mail traffic with Wireshark

Question

i've been trying to use Wireshark to capture an email i am sending from my smartphone on the same wifi network. I'm using Kali Linux (not a virtual machine), i am in monitor mode, i have set up the right wpa2 decryption key, i did capture the four way handshake and i am getting some decrypted traffic to and from the ip adress of my phone, like TCP, HTTP, DNS and some other ones. However i can't find any traffic with common mail protocols like POP, SMTP or IMAP, which i've heard are really easy to grab and read due to the lack of encryption. That was the main reason i got interested in this topic, to see if i as someone who has no clue about all that could "steal" the content of a mail. Does anyone have a tip for me?

Thanks in advance for your help.

Answer 1

Nearly all mail protocols run over TLS/SSL these days, either by upgrading after connecting (SMTP uses the STARTTLS command to upgrade) or on alternate ports that require a SSL/TLS handshake before starting to pass the protocol.

For direct TLS/SSL the following ports are used:

• IMAP 993
• POP3 995
• SMTP 465