1 1 00:00:00,870 --> 00:00:03,570 SMTP log analysis. 2 2 00:00:03,570 --> 00:00:05,790 So we've talked a lot about emails so far. 3 3 00:00:05,790 --> 00:00:08,220 We've looked at some headers, we've looked at phishing. 4 4 00:00:08,220 --> 00:00:11,310 We've looked at things like DKIM and the DNS policies, 5 5 00:00:11,310 --> 00:00:12,180 but we really haven't talked 6 6 00:00:12,180 --> 00:00:13,560 about the email servers themselves 7 7 00:00:13,560 --> 00:00:14,880 and going through their logs. 8 8 00:00:14,880 --> 00:00:17,430 And that's what we're going to focus on in this lesson. 9 9 00:00:17,430 --> 00:00:19,980 Now, SMTP logs are typically going to be formatted 10 10 00:00:19,980 --> 00:00:22,320 in request/response fashion. 11 11 00:00:22,320 --> 00:00:24,990 Now what this means is you're going to get a series of logs 12 12 00:00:24,990 --> 00:00:27,240 that are going to show you a couple of pieces of information, 13 13 00:00:27,240 --> 00:00:29,880 things like the time of request or response. 14 14 00:00:29,880 --> 00:00:31,950 We're also going to see the address of the recipient. 15 15 00:00:31,950 --> 00:00:33,630 We're going to see the size of the message, 16 16 00:00:33,630 --> 00:00:35,640 and we're going to see the status code. 17 17 00:00:35,640 --> 00:00:36,840 Now, as we go through the lesson, 18 18 00:00:36,840 --> 00:00:39,000 we're going to talk about some of these in more depth. 19 19 00:00:39,000 --> 00:00:39,960 For instance, we don't really need 20 20 00:00:39,960 --> 00:00:41,640 to talk about the time of request and response 21 21 00:00:41,640 --> 00:00:42,960 because that's pretty easy. 22 22 00:00:42,960 --> 00:00:44,340 It's whatever the time was. 23 23 00:00:44,340 --> 00:00:45,870 The address, it's who you sent it to. 24 24 00:00:45,870 --> 00:00:48,000 The size of the message is how large it is. 25 25 00:00:48,000 --> 00:00:48,900 The status code, 26 26 00:00:48,900 --> 00:00:51,000 that's something we should spend a little bit of time on. 27 27 00:00:51,000 --> 00:00:52,710 Let's talk about some of the specific status code 28 28 00:00:52,710 --> 00:00:53,543 you might want to know 29 29 00:00:53,543 --> 00:00:55,200 if you're doing a log analysis. 30 30 00:00:55,200 --> 00:00:59,400 First, code 220, this indicates that the server is ready. 31 31 00:00:59,400 --> 00:01:01,380 Essentially, I've received this code 32 32 00:01:01,380 --> 00:01:03,690 and I am ready to do some kind of processing 33 33 00:01:03,690 --> 00:01:05,040 on the thing you're going to send me. 34 34 00:01:05,040 --> 00:01:07,110 I'm ready to take something in, send it to me. 35 35 00:01:07,110 --> 00:01:08,340 That's what that means. 36 36 00:01:08,340 --> 00:01:09,900 When we deal with code 250, 37 37 00:01:09,900 --> 00:01:12,270 this indicates that the message has been accepted. 38 38 00:01:12,270 --> 00:01:15,000 So if I sent a message over to your SMTP server, 39 39 00:01:15,000 --> 00:01:18,390 it's going to send you back a status code of code 250 saying, 40 40 00:01:18,390 --> 00:01:20,160 I have received it, I've accepted it. 41 41 00:01:20,160 --> 00:01:21,570 You don't have to send it again. 42 42 00:01:21,570 --> 00:01:22,710 Because usually with email, 43 43 00:01:22,710 --> 00:01:25,140 if it bounces back, they're going to try and try again 44 44 00:01:25,140 --> 00:01:26,520 until it finally gets successful 45 45 00:01:26,520 --> 00:01:28,530 or a certain amount of time has passed. 46 46 00:01:28,530 --> 00:01:31,380 The next one we're going to talk about is code 421. 47 47 00:01:31,380 --> 00:01:34,140 And this indicates the service is not available. 48 48 00:01:34,140 --> 00:01:35,760 Maybe you're trying to send a message to a server 49 49 00:01:35,760 --> 00:01:37,530 and that server happens to be down right now. 50 50 00:01:37,530 --> 00:01:39,840 If so, you'll get a code 421. 51 51 00:01:39,840 --> 00:01:41,340 Maybe they've turned off the server, 52 52 00:01:41,340 --> 00:01:42,540 maybe the server's having an issue, 53 53 00:01:42,540 --> 00:01:44,880 maybe for some reason it just can't process it. 54 54 00:01:44,880 --> 00:01:47,820 Whatever the reason, that would be error code 421. 55 55 00:01:47,820 --> 00:01:50,070 The next one is code 450. 56 56 00:01:50,070 --> 00:01:52,320 Now, code 450 indicates that the server 57 57 00:01:52,320 --> 00:01:55,260 cannot access the mailbox to deliver a message. 58 58 00:01:55,260 --> 00:01:56,670 Maybe it doesn't have permissions, 59 59 00:01:56,670 --> 00:01:58,740 maybe the mailbox doesn't exist. 60 60 00:01:58,740 --> 00:02:00,780 Perhaps you tried to send something to Jason Dion 61 61 00:02:00,780 --> 00:02:03,660 at diontraining.com, and that's not really my email. 62 62 00:02:03,660 --> 00:02:05,160 So it's going to bounce back and say, 63 63 00:02:05,160 --> 00:02:06,810 I can't access that mailbox. 64 64 00:02:06,810 --> 00:02:08,490 Or for some reason it just can't access 65 65 00:02:08,490 --> 00:02:11,280 my real mailbox right now because there's an issue. 66 66 00:02:11,280 --> 00:02:13,470 The next thing we want to talk about is 451. 67 67 00:02:13,470 --> 00:02:16,590 And code 451 is going to indicate that the local server 68 68 00:02:16,590 --> 00:02:19,230 aborted the action due to a processing error. 69 69 00:02:19,230 --> 00:02:20,460 Something happened on that server 70 70 00:02:20,460 --> 00:02:21,750 and it's just not going to work. 71 71 00:02:21,750 --> 00:02:24,630 So it tells you, I'm not working right now, sorry. 72 72 00:02:24,630 --> 00:02:26,310 Then we have code 452. 73 73 00:02:26,310 --> 00:02:27,840 This indicates that the local server 74 74 00:02:27,840 --> 00:02:30,180 has insufficient storage space available. 75 75 00:02:30,180 --> 00:02:31,230 So what does this mean? 76 76 00:02:31,230 --> 00:02:33,270 It means your drive has filled up. 77 77 00:02:33,270 --> 00:02:35,400 For instance, maybe you have a one terabyte hard drive 78 78 00:02:35,400 --> 00:02:38,400 and that hard drive is now at 999 gigabytes 79 79 00:02:38,400 --> 00:02:40,650 and you just sent a very large message 80 80 00:02:40,650 --> 00:02:42,150 and it just doesn't have room to store it. 81 81 00:02:42,150 --> 00:02:44,130 That's what a code 452 is. 82 82 00:02:44,130 --> 00:02:47,400 Hopefully, you never get that code, but sometimes you will. 83 83 00:02:47,400 --> 00:02:49,890 Now, let's take a look at some logs and what they look like. 84 84 00:02:49,890 --> 00:02:51,510 Here's an example of a log. 85 85 00:02:51,510 --> 00:02:53,760 You'll see SMTPD on the left, 86 86 00:02:53,760 --> 00:02:57,780 which is the Linux SMTP server, the SMTP daemon. 87 87 00:02:57,780 --> 00:03:00,210 You'll see the log entry there in the second column. 88 88 00:03:00,210 --> 00:03:01,260 And then as you keep going to the right, 89 89 00:03:01,260 --> 00:03:03,480 you're going to see the date, the time, 90 90 00:03:03,480 --> 00:03:05,430 the IP address that it received it from, 91 91 00:03:05,430 --> 00:03:06,360 and then the messages. 92 92 00:03:06,360 --> 00:03:07,590 And these are really what I want to focus 93 93 00:03:07,590 --> 00:03:09,630 is over here on the right side. 94 94 00:03:09,630 --> 00:03:12,480 So as we see the first line, you'll see SENT: 220. 95 95 00:03:12,480 --> 00:03:13,800 Now what does that mean? 96 96 00:03:13,800 --> 00:03:15,990 It means that this server that we're looking at, 97 97 00:03:15,990 --> 00:03:18,810 our server, sent out message 220 saying, 98 98 00:03:18,810 --> 00:03:20,610 I am ready to receive something 99 99 00:03:20,610 --> 00:03:23,237 to the mail server at 515support.com. 100 100 00:03:23,237 --> 00:03:25,890 And it sent it out over SMTP. 101 101 00:03:25,890 --> 00:03:26,940 Then we get RECEIVED. 102 102 00:03:26,940 --> 00:03:31,530 It received a message from smtp.openmail.foo. 103 103 00:03:31,530 --> 00:03:33,843 Now our third line says, SENT: 250. 104 104 00:03:34,680 --> 00:03:36,120 What does 250 mean? 105 105 00:03:36,120 --> 00:03:38,460 250 means I have accepted your message. 106 106 00:03:38,460 --> 00:03:42,360 So I received the message from mail.515support.com 107 107 00:03:42,360 --> 00:03:43,800 and I have accepted it. 108 108 00:03:43,800 --> 00:03:46,470 Now I'm going to log that I have received that message. 109 109 00:03:46,470 --> 00:03:47,940 And I received the message where? 110 110 00:03:47,940 --> 00:03:51,300 I received it from getrich@bitminer.foo. 111 111 00:03:51,300 --> 00:03:55,650 And I see the size of it, 20480000. 112 112 00:03:55,650 --> 00:03:58,920 And I see that, again, 250 authenticated log in, 113 113 00:03:58,920 --> 00:04:00,810 which means I received it and I'm good. 114 114 00:04:00,810 --> 00:04:03,690 I then send back a 250 saying, I've accepted it. 115 115 00:04:03,690 --> 00:04:08,690 I then say, RECEIVED, recipient is sam@515support.com. 116 116 00:04:08,790 --> 00:04:11,400 SENT: 250 OK, meaning I received it 117 117 00:04:11,400 --> 00:04:12,900 and I'm sending back the acknowledgement. 118 118 00:04:12,900 --> 00:04:14,190 RECEIVED: DATA, 119 119 00:04:14,190 --> 00:04:17,820 send back 354, okay, send me what you need to. 120 120 00:04:17,820 --> 00:04:19,440 Then I get SENT: 250. 121 121 00:04:19,440 --> 00:04:21,060 Again, I accepted that message. 122 122 00:04:21,060 --> 00:04:22,230 I'm in queue. 123 123 00:04:22,230 --> 00:04:23,640 I waited 11 seconds, 124 124 00:04:23,640 --> 00:04:24,750 then I received, 125 125 00:04:24,750 --> 00:04:25,710 and then I quit. 126 126 00:04:25,710 --> 00:04:28,080 And then I sent 221, which is the goodbye message. 127 127 00:04:28,080 --> 00:04:30,300 So this is basically the handshake that you see. 128 128 00:04:30,300 --> 00:04:31,560 It's I'm ready to receive, 129 129 00:04:31,560 --> 00:04:32,393 I've received it, 130 130 00:04:32,393 --> 00:04:33,300 I've got it from here, 131 131 00:04:33,300 --> 00:04:34,260 I got the information, 132 132 00:04:34,260 --> 00:04:35,130 everything's good, 133 133 00:04:35,130 --> 00:04:36,930 okay, quit, bye. 134 134 00:04:36,930 --> 00:04:37,800 This is normal. 135 135 00:04:37,800 --> 00:04:39,000 But the only thing that looks 136 136 00:04:39,000 --> 00:04:40,830 really out of the ordinary to us here 137 137 00:04:40,830 --> 00:04:42,330 would be the fact that this mail 138 138 00:04:42,330 --> 00:04:45,120 came from bitminer.foo getrich@, 139 139 00:04:45,120 --> 00:04:47,700 which is probably some kind of a spam email in this case. 140 140 00:04:47,700 --> 00:04:49,800 And then we might want to go look at Sam's mailbox 141 141 00:04:49,800 --> 00:04:51,690 and make sure that Sam is not clicking on that link 142 142 00:04:51,690 --> 00:04:53,400 cuz it might have some bad things in it. 143 143 00:04:53,400 --> 00:04:55,860 And this is the way you do a basic SMTP analysis 144 144 00:04:55,860 --> 00:04:57,210 as you read these logs. 145 145 00:04:57,210 --> 00:04:59,760 As I said, reading through is pretty easy. 146 146 00:04:59,760 --> 00:05:01,710 What you want to look at is some of the major codes. 147 147 00:05:01,710 --> 00:05:04,470 Things like 220 and 250 are very common. 148 148 00:05:04,470 --> 00:05:05,670 Some of the other ones in here, 149 149 00:05:05,670 --> 00:05:06,960 you really don't need to know the specifics, 150 150 00:05:06,960 --> 00:05:09,120 like 354 or 221. 151 151 00:05:09,120 --> 00:05:11,670 I mentioned a lot of codes in this lesson. 152 152 00:05:11,670 --> 00:05:15,420 But really, if you just focus on 220 and 250 for the exam, 153 153 00:05:15,420 --> 00:05:16,720 you're going to do just fine.