[Bro] MAIL FROM in smtp.bro

frenzy at frenzy.org frenzy at frenzy.org
Tue Sep 26 11:13:20 PDT 2006

Hi folks,

I was wondering why the following code is commented out of smtp.bro? I
have a patch that looks for "MAIL FROM" and sets those as the
sender in the smtp logs. It adds a couple of functions to mimic the
structure of extract_recipient() etc. The functionality seems to work
well. All of the valid sender addresses seem to get captured, though I 
have not done exhaustive testing for invalid addresses.

in policy/smtp.bro

   508          #       else if ( cmd == "MAIL" && code == 250 )
   509          #               smtp_command_mail(session, cmd_info);

However, if there is a reason why we shouldn't be doing this, I won't 
submit the patch.



"Sed Quis Custodiet Ipsos Custodes?" -Juvenal

More information about the Bro mailing list