8.36. SMTP Keywords

8.36.1. file.name

The file.name keyword can be used at the SMTP application level.

Signature Example:

alert smtp any any -> any any (msg:"SMTP file.name usage"; file.name; content:"winmail.dat"; classtype:bad-unknown; sid:1; rev:1;)

For additional information on the file.name keyword, see File Keywords.

8.36.2. Frames

The SMTP parser supports the following frames:

• smtp.command_line

• smtp.response_line

• smtp.data

• smtp.stream

8.36.2.1. smtp.command_line

A single line from the client to the server. Multi-line commands will have a frame per line. Lines part of the SMTP DATA transfer are excluded.

alert smtp any any -> any any ( frame:smtp.command_line; content:"MAIL|20|FROM:"; startswith; sid:1;)

8.36.2.2. smtp.response_line

A single line from the server to the client. Multi-line commands will have a frame per line.

alert smtp any any -> any any ( frame:smtp.response_line; content:"354 go ahead"; startswith; sid:1;)

8.36.2.3. smtp.data

A streaming buffer containing the DATA bytes sent from client to server.

alert smtp any any -> any any ( frame:smtp.data; content:"Reply-To:"; startswith; content:"Subject"; distance:0; sid:1;)

8.36.2.4. smtp.stream

Streaming buffer of the entire TCP data for the SMTP session.

alert smtp any any -> any any (flow:to_client; frame:smtp.stream; content:"250 ok|0d 0a|354 go ahead"; sid:1;)