Next: , Previous: login Analyzer, Up: Analyzers and Events


7.22 The pop3 Analyzer

The pop3 analyzer does a protocol analysis of the Post Office Protocol - Version 3.

When Bro runs with the pop3 Analyzer, it processes all packets with destination port 110/tcp, generating a log file pop3.log. Each line contains a timestamp, a connection ID, the originator and responder IP addresses, and the message sent. The message consists of the command and arguments on client side, and the status on server side.