spam mail message collector

Hello Bro. I am new to bro.

I think my task is more suitable to Bro than other NIDS.

There is a list of spammer email addresses and

I want to save the email subject and whole message of them.

(reassembled payload of tcp segments)

I tried a few events like log_smtp, tcp_contents but couldn’t save the whole stream.

Can anybody guide me to the right way, please?

You could just use file extraction. This will extract many files for multipart messages.


Add a file and load it that does the following hook:

hook FileExtraction::extract(f: fa_file, meta: fa_metadata) &priority=10


if ( f$source == “SMTP” )