spam mail message collector

Zeek
1

Hello Bro. I am new to bro.

I think my task is more suitable to Bro than other NIDS.

There is a list of spammer email addresses and

I want to save the email subject and whole message of them.

(reassembled payload of tcp segments)

I tried a few events like log_smtp, tcp_contents but couldn’t save the whole stream.

Can anybody guide me to the right way, please?

2

You could just use file extraction. This will extract many files for multipart messages.

Try: https://github.com/hosom/bro-file-extraction

Add a file and load it that does the following hook:

hook FileExtraction::extract(f: fa_file, meta: fa_metadata) &priority=10

{

if ( f$source == “SMTP” )

break;

}