how to capture only SMTP using latest Wireshark 2.2.6 or later

Question

I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP. I would also like to use Wireshark to show the contents of the SMTP message to see if it is what I sent.

I cannot figure out, nor find help, on just simply making Wireshark show only SMTP. Wireshark doc says to set filter to SMTP, but that does not work for me.

Solution

You can also use the port filtering for this. Since, SMTP has port number of 25. So you can use this to set the filter. This can be something like this:
tcp.port eq 25

And this should also have worked for you. use this in your capture filter:

tcp port smtp

Also if you want to just see what you have sent then you can use the filter with your IP address like:

ip.src==192.168.1.12

Here in this case, 192.168.1.12 is my IP address, i.e., source IP address. You can certainly combine them too and this will look like:

(ip.src==192.168.1.12) and (tcp.port eq 25)

Comments

[Steve Reeder]

Are you running the packet capture on the same machine (AzureVM) that you are receiving SMTP on? If not, you will only see broadcasts and multicasts if you are capturing packets unless you have some way to turn on port mirroring or SPAN

[konqui]

there are to way one would be to just capture the whole traffic and then filter it to smtp protocol but since all the traffic is captured this may generate huge files so if you only interested in smtp it would be more usefull to work with a capture filter wiki.wireshark.org/CaptureFilters if you wanna know what exactly is the difference take a look here ask.wireshark.org/questions/6660/… - since you're working with VM make shure you capture on the Virtual VM-Interface not on the Real Networkcard

[Doug Null]

Yes, running Wireshark on the Azure VM Windows server that is receiving SMTP email.