Jason: SMTP log analysis. 2 2
So we've talked a lot about emails so far. 3 3
We've looked at some headers, we've looked at phishing. 4 4
We've looked at things like DKIM and the DNS policies, 5 5
but we really haven't talked 6 6
about the email servers themselves 7 7
and going through their logs. 8 8
And that's what we're going to focus on in this lesson. 9 9
Now, SMTP logs are typically going to be formatted 10 10
in request/response fashion. 11 11
Now what this means is you're going to get a series of logs 12 12
that are going to show you a couple of pieces of information, 13 13
things like the time of request or response. 14 14
We're also going to see the address of the recipient. 15 15
We're going to see the size of the message, 16 16
and we're going to see the status code. 17 17
Now, as we go through the lesson, 18 18
we're going to talk about some of these in more depth. 19 19
For instance, we don't really need 20 20
to talk about the time of request and response 21 21
because that's pretty easy. 22 22
It's whatever the time was. 23 23
The address, it's who you sent it to. 24 24
The size of the message is how large it is. 25 25
The status code, 26 26
that's something we should spend a little bit of time on. 27 27
Let's talk about some of the specific status code 28 28
you might want to know 29 29
if you're doing a log analysis. 30 30
First, code 220, this indicates that the server is ready. 31 31
Essentially, I've received this code 32 32
and I am ready to do some kind of processing 33 33
on the thing you're going to send me. 34 34
I'm ready to take something in, send it to me. 35 35
That's what that means. 36 36
When we deal with code 250, 37 37
this indicates that the message has been accepted. 38 38
So if I sent a message over to your SMTP server, 39 39
it's going to send you back a status code of code 250 saying, 40 40
I have received it, I've accepted it. 41 41
You don't have to send it again. 42 42
Because usually with email, 43 43
if it bounces back, they're going to try and try again 44 44
until it finally gets successful 45 45
or a certain amount of time has passed. 46 46
The next one we're going to talk about is code 421. 47 47
And this indicates the service is not available. 48 48
Maybe you're trying to send a message to a server 49 49
and that server happens to be down right now. 50 50
If so, you'll get a code 421. 51 51
Maybe they've turned off the server, 52 52
maybe the server's having an issue, 53 53
maybe for some reason it just can't process it. 54 54
Whatever the reason, that would be error code 421. 55 55
The next one is code 450. 56 56
Now, code 450 indicates that the server 57 57
cannot access the mailbox to deliver a message. 58 58
Maybe it doesn't have permissions, 59 59
maybe the mailbox doesn't exist. 60 60
Perhaps you tried to send something to Jason Dion 61 61
at diontraining.com, and that's not really my email. 62 62
So it's going to bounce back and say, 63 63
I can't access that mailbox. 64 64
Or for some reason it just can't access 65 65
my real mailbox right now because there's an issue. 66 66
The next thing we want to talk about is 451. 67 67
And code 451 is going to indicate that the local server 68 68
aborted the action due to a processing error. 69 69
Something happened on that server 70 70
and it's just not going to work. 71 71
So it tells you, I'm not working right now, sorry. 72 72
Then we have code 452. 73 73
This indicates that the local server 74 74
has insufficient storage space available. 75 75
So what does this mean? 76 76
It means your drive has filled up. 77 77
For instance, maybe you have a one terabyte hard drive 78 78
and that hard drive is now at 999 gigabytes 79 79
and you just sent a very large message 80 80
and it just doesn't have room to store it. 81 81
That's what a code 452 is. 82 82
Hopefully, you never get that code, but sometimes you will. 83 83
Now, let's take a look at some logs and what they look like. 84 84
Here's an example of a log. 85 85
You'll see SMTPD on the left, 86 86
which is the Linux SMTP server, the SMTP daemon. 87 87
You'll see the log entry there in the second column. 88 88
And then as you keep going to the right, 89 89
you're going to see the date, the time, 90 90
the IP address that it received it from, 91 91
and then the messages. 92 92
And these are really what I want to focus 93 93
is over here on the right side. 94 94
So as we see the first line, you'll see SENT: 220. 95 95
Now what does that mean? 96 96
It means that this server that we're looking at, 97 97
our server, sent out message 220 saying, 98 98
I am ready to receive something 99 99
to the mail server at 515support.com. 100 100
And it sent it out over SMTP. 101 101
Then we get RECEIVED. 102 102
It received a message from smtp.openmail.foo. 103 103
Now our third line says, SENT: 250. 104 104
What does 250 mean? 105 105
250 means I have accepted your message. 106 106
So I received the message from mail.515support.com 107 107
and I have accepted it. 108 108
Now I'm going to log that I have received that message. 109 109
And I received the message where? 110 110
I received it from getrich@bitminer.foo. 111 111
And I see the size of it, 20480000. 112 112
And I see that, again, 250 authenticated log in, 113 113
which means I received it and I'm good. 114 114
I then send back a 250 saying, I've accepted it. 115 115
I then say, RECEIVED, recipient is sam@515support.com. 116 116
SENT: 250 OK, meaning I received it 117 117
and I'm sending back the acknowledgement. 118 118
RECEIVED: DATA, 119 119
send back 354, okay, send me what you need to. 120 120
Then I get SENT: 250. 121 121
Again, I accepted that message. 122 122
I'm in queue. 123 123
I waited 11 seconds, 124 124
then I received, 125 125
and then I quit. 126 126
And then I sent 221, which is the goodbye message. 127 127
So this is basically the handshake that you see. 128 128
It's I'm ready to receive, 129 129
I've received it, 130 130
I've got it from here, 131 131
I got the information, 132 132
everything's good, 133 133
okay, quit, bye. 134 134
This is normal. 135 135
But the only thing that looks 136 136
really out of the ordinary to us here 137 137
would be the fact that this mail 138 138
came from bitminer.foo getrich@, 139 139
which is probably some kind of a spam email in this case. 140 140
And then we might want to go look at Sam's mailbox 141 141
and make sure that Sam is not clicking on that link 142 142
cuz it might have some bad things in it. 143 143
And this is the way you do a basic SMTP analysis 144 144
as you read these logs. 145 145
As I said, reading through is pretty easy. 146 146
What you want to look at is some of the major codes. 147 147
Things like 220 and 250 are very common. 148 148
Some of the other ones in here, 149 149
you really don't need to know the specifics, 150 150
like 354 or 221. 151 151
I mentioned a lot of codes in this lesson. 152 152
But really, if you just focus on 220 and 250 for the exam, 153 153
you're going to do just fine.