Project

Prepare report on analysis of any one of the Application protocol

Application protocol under study - SMTP

SMTP which is simple mail transfer protocol is used to send and receive the electronically generated mails.

SMTP servers uses TCP protocol on port 25 and 587 in general. It uses port 25 for plain text only and port 587 for encrypted data.

In order to explore it's working I had to enable telnet on my test PC and made use of command line in oder to capture the behaior of mail transmission using SMTP.

I started my wireshark capture on the wi-fi interface and then opened my command promt after having enabled the telnet on my PC.

Then in order to test this on port 587 I have used the following command.

telnet smtp.gmail.com 587

The commands let you connect to an SMTP server.

here, you are going to observe this on your screen

220 mx.google.com ESMTP ji3-20020a170903324300b00194997fbc75si1721099plb.211 - gsmtp

220 here is a response code I received from the server which implies that my service is ready

Then, I type

helo "some random word".

Having typed this you are going to observe this

250 mx.google.com at your service

The response code here is 250. It implies that requested mail action okay, completed.

Then I tried using the general mail format.

mail from: <"your mail"> and pressed enter

the response code I received was 530 implying that I will need a start tls command in order to use the function of sending mail.

Then I just typed quit to record the closing action on wireshark.

The trace was captured on my wireshark. I have attached the file "SMTP 587".

When I redid it with TLS on I observed that the host was losing the connection pretty soon. I have attached the respective pcap file "port 587 take 2"

I tried to understand the process by first making a tcp.port filter for the first process where tls was not active. Here, 220 was the response code as the TLS was ready.SMTP packet data

tcp.port==587 since that's the port I have set.

I observed 3-way TCP hand shake first. Here, an attempt to establish a connection was made with the server and this was followed by the first SMTP message which had my response code 220.

This is followed by some Ack and Psh, Ack messages where my tcp segments are getting retransmitted and reassembled.

Then, I analyse the packet where I have typed the message helo xxxx on command line. Here, the command is helo and the part randomly written becomes the request parameter.

C here imples the client and S is the server we are having contact with.

As you can see there's an ack message followed by the server response with code 250 here.

After few segement transmissions this where I type my next command "MAIL FROM:<maid id>".(Not adding <> to the address will give a syntax error.

You can see the command and request parameter given from the smpt packet data

the server reponse after few segment transmissions

SMTP packet details

Having received that response code I have typed the command "quit" following which I receive the response code 221 indicating the closing of the connection. This is followed by Fin, Ack message and all other TCp segmenets follow the suit.

That's how my connection is terminated.

Following is the sequence of communication observed on tcp stream

I have tried using port 25 for another attempt which didn't require a tls. Seems it didn't go through and the host lost the connection but I was able to get a go ahead. The problem might be due to gmail blocking this execution. Probably requires some kinda of setup to execute this flawlessly.

I have attached the PCAPNG file "SMTP port 25". Actually, this should be followed by a 250 response code Qued for delivery following which I can go ahead and use the quit command.

So my sequence of communication went like this bwhen I looked at the TCP stream

Filtered using SMTP command

So having used both the tcp ports I understand that a tls session was needed with port 587 for data encryption which secures it while on port 25 it's simply plain text and not that secure and mail data was somehow captured. But port 25 can be set up with a TLS session too in order to encrypt your message.

Even then I am losing the connection to host immedietly after the TLS session starts.

When I observed the tcp filter I see the session closing down on it's own and the host has been disconnected.

An actual tls session should start with a handshake where in some credials are exchanged with the server in order to ensure that data is encrypted.

So What I gather by performing the tests in different stages the entire call flow will look like this.TCP

TCP trace graph analysis of file "smtp 587".Here there are spurious retransmission at the beginning and ending of the capture.

The green line in this tcp trace graph server to client indicates window size. Yellow lines are the packets that are sending. The blue line I observe overlapping on the yellow line indicates that there's retransmission over the particular sequence.

TCP trace graph from client to server

A blue line escaping the ack yellow line. It's skipping a couple of sequences. Probably it's out of order. The blue line crosses the receiving window size at a point. There must be issues in the retransmission. TCP Acked few unseen segments. Don't see any DUP acks. So, I can conclude that packet losses are minimal. No red lines observed.

Now, I have a look at expert information.

So from here I can see that there was 1 DUP ack.So, there was a slight packet loss maybe. Exanding this I will see that there's 8 D-SACK sequences that compiles the DUP-ACK and all the acked but unseen segements. Bunch of packets just didn't get recorded.

As far as the security analysis goes I can go as far as to conclude the importance of having to setup a tls protocol in order to encrypt the data. Else, the data is potentially threatened.