From owner-freebsd-isp@FreeBSD.ORG  Tue Apr 13 12:20:37 2004
Return-Path: <owner-freebsd-isp@FreeBSD.ORG>
Delivered-To: freebsd-isp@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 00D6E16A4CE
	for <freebsd-isp@freebsd.org>; Tue, 13 Apr 2004 12:20:37 -0700 (PDT)
Received: from mail.mi.celestial.com (dagney.celestial.com [192.136.111.7])
	by mx1.FreeBSD.org (Postfix) with ESMTP id C55C443D60
	for <freebsd-isp@freebsd.org>; Tue, 13 Apr 2004 12:20:36 -0700 (PDT)
	(envelope-from bill@celestial.com)
Received: by mail.mi.celestial.com (Postfix, from userid 203)
	id 28E8611E8AA; Tue, 13 Apr 2004 12:20:36 -0700 (PDT)
Date: Tue, 13 Apr 2004 12:20:36 -0700
From: Bill Campbell <freebsd@celestial.com>
To: freebsd-isp@freebsd.org
Message-ID: <20040413192036.GA57348@alexis.mi.celestial.com>
Mail-Followup-To: freebsd-isp@freebsd.org
References: <20040413180323.GA13554@mind.net>
	<1081881451.14526.77.camel@unixws1>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1081881451.14526.77.camel@unixws1>
User-Agent: Mutt/1.4.1i
Subject: Re: tcpdump for sniffing POP3 -- methods ?
X-BeenThere: freebsd-isp@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: freebsd@celestial.com
List-Id: Internet Services Providers <freebsd-isp.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-isp>
List-Post: <mailto:freebsd-isp@freebsd.org>
List-Help: <mailto:freebsd-isp-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 13 Apr 2004 19:20:37 -0000

On Tue, Apr 13, 2004, Adam Maloney wrote:
>I've done this in the past.  I had tcpdump spitting out all the dst port
>110 packets to a file.  Then a perl script with Net::TCPDump (or
>whatever it's called) to parse it.

The tcpflow program makes this far easier as it separates each
connection out into its own file.  The command line options for
tcpflow are about the same as tcpdump.

Bill
--
INTERNET:   bill@Celestial.COM  Bill Campbell; Celestial Software LLC
UUCP:               camco!bill  PO Box 820; 6641 E. Mercer Way
FAX:            (206) 232-9186  Mercer Island, WA 98040-0820; (206) 236-1676
URL: http://www.celestial.com/

It's very glamorous to raise millions of dollars, until it's time for the
venture capitalist to suck your eyeballs out.
		-- Peter Kennedy, chairman of Kraft & Kennedy.