Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations derfloh on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

SMTP Traffic Log

Status
Not open for further replies.

rrgg

Technical User
Joined
Jun 20, 2003
Messages
35
Location
IT
I have this entry in my PIX configuration.

logging on
logging buffered notifications
logging trap notifications
logging host inside 192.168.1.120

When I read log files, I don't see SMTP traffic trace.
Why this?

I would want also to see the traces of any VPN mobile connection, how to improve this?

Tks all.

 
Any idea??
 
I would like to know the answer to this too!
Thanks,
-Dave
 
like SMTP HELO/OK transacations?

perhaps if you jack up the PIX log level.

Else id just set ethereal on a filtered sniff....

 
Not really. The logs will currently show somthing like:
304001: 192.168.1.70 Accessed URL 207.68.173.254:/index.htm

What I am looking for is the same thing except for it to show 'Accessed SMTP'. Right now it dosen't show any SMTP connections, just URL and JAVA.
 
I think that might only work when you have the SMTP fixups turned on... Do have them enabled?

 
Setting the logging level to 6 would enable the recording of the "Built..", "Teardown..." messages and those will capture any type of traffic, not only SMTP. See the following report obtained from a PIX firewall set to logging level 6:


The SMTP fixup simply restricts the type of SMTP commands that PIX would accept (and it may "break" some features like SMTP authentication). I do not think that it enables more detailed logging of the SMTP traffic.


Adrian Grigorof
FireGen for Pix Log Analyzer
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top