# SMTP Analyzer

**URL:** <https://community.zeek.org/t/smtp-analyzer/1244>\
**Category:** Zeek\
**Created:** [October 10, 2007, 11:52pm UTC](https://community.zeek.org/t/smtp-analyzer/1244 "2007-10-10T23:52:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thorkill](https://avatars.discourse-cdn.com/v4/letter/t/4af34b/32.png) [@Thorkill](https://community.zeek.org/u/Thorkill)\
**Post date:** [October 10, 2007, 11:52pm UTC](https://community.zeek.org/t/smtp-analyzer/1244/1 "2007-10-10T23:52:38Z")

</div>

Hello all,

since few weeks I'm watching bruteforce attacks on SMTP AUTH.

It does looks like this:

2007-08-28 22:00:33 plain\_login authenticator failed for (ameill-2007) [222.183.149.252]: 535 Incorrect authentication data (set\_id=company)  
2007-09-30 07:41:11 plain\_login authenticator failed for (ameill-2007) [222.183.160.28]: 535 Incorrect authentication data (set\_id=administrator)  
2007-09-30 21:26:16 plain\_login authenticator failed for (windows) [64.72.227.37]: 535 Incorrect authentication data (set\_id="null")

Affected box is running exim (just as info). I would like to make bro recognize such attacks, so could someone be so kind and give me some hints where to strart? I have checked out src/SMTP.cc, policy/smtp.bro but it is kind weird.

First problem I can't solve "ad hoc" is:

1192050353.634741 #136 xx.xx.33.62/20241 \> xx.xx.xx.44/smtp start external  
1192050395.930749 #136 error: command mismatch: \*\*(4) [cmd=\*\*, cmd\_arg=IQ==, reply=0, reply\_arg=, cont\_reply=F, log\_reply=F](4), AUTH\_ANSWER (334 UGFzc3dvcmQ6)  
1192050397.092847 #136 error: command mismatch: \*\*(5) [cmd=\*\*, cmd\_arg=, reply=0, reply\_arg=, cont\_reply=F, log\_reply=F](5), AUTH\_ANSWER (235 Authentication succeeded)  
1192050399.164633 #136 finish

session does look like this:

\>\> my input  
\<\< server response

> > EHLO test.pl

SMTP\<\< 250 banner

> > AUTH LOGIN

SMTP\<\< 334 VXNlcm5hbWU6

> > IQ==

SMTP\<\< 334 UGFzc3dvcmQ6

> > \<simply\_enter\>

SMTP\<\< 235 Authentication succeeded

so commands are in good sequence yet bro does tell me that it is wrong.

Where should I start with fixing, I'm familiar with bro language, have wrote many other policies from scratch for our company, but I'm a little bit confused where to start with SMTP.

thx and kind regards,  
Rafal

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [October 12, 2007, 1:01am UTC](https://community.zeek.org/t/smtp-analyzer/1244/2 "2007-10-12T01:01:19Z")

</div>

> since few weeks I'm watching bruteforce attacks on SMTP AUTH.

Could you send a trace of one of these attacks? That would be the easiest  
way for us to figure out whether the necessary events are already available,  
or if the event engine would need any extension to handle this.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/smtp-analyzer/1244/3 "2022-05-06T15:38:23Z")

</div>