[Bro] SMTP connection states in SMTP analyzer

Wed Jan 19 00:55:43 PST 2011

Hello, everyone!

The question is about SMTP states in SMTP analyzer.

The state of SMTP analyzer becomes "SMTP_INITIATED" after SMTP command
"AUTH" and SMTP replay 235. And next command "MAIL TO" leads to event "SMTP
command unexpected", but as I know this is not right(They can perform
command "MAIL TO" right now after success authorization, and it is not
"unexpected").

As I found inside source code, it must be state "SMTP_READY" after SMTP
reply 235 for command "AUTH". Is it right?

I'm sorry if I'm wrong and something has not considered.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20110119/80d7668a/attachment.html 