Packet capture analysis of pop3 by Wireshark

This paper mainly uses Wireshark to analyze the process of receiving e-mail by using POP3 protocol, and uses telnet command for simple operation.

1. POP3 introduction

Post Office Protocol (English: Post Office Protocol, abbreviation: pop) is a member of TCP/IP protocol family and is defined by RFC 1939. This protocol is mainly used to support the remote management of e-mail on the server using the client. The latest version is POP3, whose full name is "Post Office Protocol - Version 3", and the POP3 protocol that provides SSL encryption is called POP3S.

Pop supports offline mail processing. The specific process is: the sender sends the mail to the server, the recipient client uses MUA to connect to the server, and downloads all unread emails. This offline access mode is a store and forward service, which sends mail from the mail server to the personal client, which can be a variety of devices such as PC or mobile phone. The old version of POP3 protocol will delete the mail on the mail server after the mail is downloaded. The improved POP3 protocol can be selected in the configuration. It can "only download mail and not delete it on the server", which is also the mainstream operation mode of POP3 at present.

2. Packet capturing environment

wireshark is still used in the packet capture tool. The protocol tested is POP3 and the default port is 110. Similarly, TLS/SSL encryption is not used for data analysis, but the results are not a problem.

After logging in, the test account automatically synchronizes the five existing emails in the inbox, and then I sent another email to the test account. Therefore, when capturing packets, there should be only five locally cached read emails on the MUA client and one unread email that has not been downloaded on the server. This is more in line with the actual situation.

Turn on wireshark to listen to the corresponding network card, set Filter as the IP of the mail server and set the protocol as pop, and you can basically grab the required packets. Then we can Follow the TCP stream corresponding to the pop data stream to see the following complete information.

[the external chain image transfer fails. The source station may have an anti-theft chain mechanism. It is recommended to save the image and upload it directly (img-1cvptpsd-164578118981)( https://resource.tinychen.com/image-20200511131942318.png )]

It is no surprise to see the three grip and four swing of TCP, which will not be repeated here.

3. POP3 packet analysis

First of all, we can see that after the client and the server establish a connection through TCP handshake for three times, the server sends a message to the client to inform the client that the connection with POP3 server is successfully established:

Next, the client sends a CAPA command:

wiki There is a list of commonly used POP3 commands, but there is no CAPA command. Check the following reference documents in the RFC document RFC2449 More detailed definitions are found in:

Section 3 describes the CAPA response using [ABNF]. When a
capability response describes an optional command, the
SHOULD be identical to the command keyword. CAPA response tags are
case-insensitive.

​ CAPA

​ Arguments:
​ none

​ Restrictions:
​ none

​ Discussion:
​ An -ERR response indicates the capability command is not
​ implemented and the client will have to probe for
​ capabilities as before.

​ An +OK response is followed by a list of capabilities, one
​ per line. Each capability name MAY be followed by a single
​ space and a space-separated list of parameters. Each
​ capability line is limited to 512 octets (including the
​ CRLF). The capability list is terminated by a line
​ containing a termination octet (".") and a CRLF pair.

​ Possible Responses:
​ +OK -ERR

In other words, the CAPA command sent by the client is mainly used to obtain the commands that can be executed by the POP3 server, and then the POP3 server returns the corresponding + OK response and capability list follow

Next, the client starts transmitting the account and password for login. You can see that after successful login, the POP3 server returns a message indicating 6 messages and the total size of messages (25568 bytes), and then the client sends the UTF8 command to specify the encoding method, After receiving the confirmation message returned by the server, send the STAT command to request the server to send back the statistics about the mailbox (here is the total number of messages and total bytes).

Then the client continues to send the UIDL command, and the POP3 server returns the unique identifier of the mail. Each identifier of the POP3 session will be unique and always unique globally. That is, the identifier of the same e-mail is unchanged during each communication, which is helpful for MUA to compare the locally stored e-mail with the server-side e-mail, so as to know which e-mail has not been downloaded locally.

After obtaining the email identifier, the client will send the LIST command to query the number of emails and the size of each email. Here we can see that the total number and size of emails are consistent with those queried by the above STAT command.

As we said earlier, before capturing packets, there are 5 emails in the MUA and the 6th email is unread. Therefore, the client will send a RETR request to obtain the information of the 6th email:

The server first returns a message indicating OK, stating that the size of this email is 1199 bytes, and then starts to transmit the content of the whole email. The whole email content contains some standard email information (subject, body, sender, time, etc.) and some exclusive information of the corresponding email system.

The last email is in When the transmission ends, the client sends a QUIT request, and the server returns OK to end the transmission.

4. telnet operation

Like the previous SMTP, we can also use the telnet command to operate on port 110 of the server:

[root@www coremail]# telnet localhost 110
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
+OK Welcome to coremail Mail Pop3 Server (126coms[c92b4e18679ada4069d0bde6e2528ad1s])
CAPA
+OK Capability list follows
TOP
USER
PIPELINING
UIDL
LANG
UTF8
SASL PLAIN
STLS
.
USER test01@coremail.cn
+OK core mail
PASS password
+OK 6 message(s) [25568 byte(s)]
UTF8
+OK UTF-8 OK
STAT
+OK 6 25568
UIDL
+OK 6 25568
1 1tbiAQACE10Y3LsAAAAAsy
2 1tbiAQACE10Y3LsAAAACsw
3 1tbiAQACE10Y3LsAAAADsx
4 1tbiAQACE10Y3LsAAAAEs2
5 1tbiAQACE10Y3LsAAAAFs3
6 1tbiAQACE10Y3LsAAAAGs0
.
LIST
+OK 6 25568
1 7959
2 1199
3 6445
4 6469
5 2297
6 1199
.

The operation here is the same as before. In fact, we can also use the RETR command to view the contents of any email:

RETR 5
+OK 2297 octets
Received: from TINYDESKTOP (unknown [10.228.12.149])
        by www.example.com (Coremail) with SMTP id AQAAfwBXc7qLVrZeWAAAAA--.16S2;
        Sat, 09 May 2020 15:06:51 +0800 (CST)
From: "Microsoft Outlook" <test01@coremail.cn>
Sender: test01@coremail.cn
To: <test01@coremail.cn>
Subject: =?utf-8?B?TWljcm9zb2Z0IE91dGxvb2sg5rWL6K+V5raI5oGv?=
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="----=_NextPart_000_0000_01D62613.778669A0"
X-CM-TRANSID:AQAAfwBXc7qLVrZeWAAAAA--.16S2
Message-Id:<5EB6568B.000001.04520@coremail.cn>
X-Coremail-Antispam: 1UD129KBjDUn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7v73
        VFW2AGmfu7bjvjm3AaLaJ3UjIYCTnIWjp_UUUYK7AC8VAFwI0_Jr0_Gr1l1xkIjI8I6I8E
        6xAIw20EY4v20xvaj40_Wr0E3s1l1IIY67AEw4v_Jr0_Jr4l8cAvFVAK0II2c7xJM28Cjx
        kF64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWUJVWUCwA2z4x0Y4vE2Ix0cI8I
        cVCY1x0267AKxVWUJVW8JwA2z4x0Y4vEx4A2jsIE14v26r1j6r4UM28EF7xvwVC2z280aV
        CY1x0267AKxVWUJVW8JwAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv
        0487Mc02F40E4c8EcI0Er2xKeI8DMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67
        AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IY64vIr41lF7I21c0EjII2zVCS
        5cI20VAGYxC7M4xvF2IEb7IF0Fy264kE64k0F24lw4CEF2IF47xS0VAv8wCF04k20xvY0x
        0EwIxGrwCF04k20xvE0xIIj40Ec7CjxwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02
        F40E14v26r106r1rMI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jr0_Jr
        ylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7Cj
        xVAFwI0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6rW3Jr0E3s1lIxAIcVC2z280aVAFwI
        0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVWUJVW8JbIYCTnIWIevJa73UjIFyTuYvjfU
        jiiSDUUUU
Date: Sat, 9 May 2020 15:06:51 +0800 (CST)
X-CM-SenderInfo: hwhv3imr6f02phpdxzgofq/

This is a multipart message in MIME format.

------=_NextPart_000_0000_01D62613.778669A0
Content-Type: text/plain;
        charset="utf-8"
Content-Transfer-Encoding: base64

6L+Z5piv5Zyo5rWL6K+V5L2g55qE5biQ5oi36K6+572u5pe2IE1pY3Jvc29mdCBPdXRsb29rIOiH
quWKqOWPkemAgeeahOeUteWtkOmCruS7tuOAgg0K

------=_NextPart_000_0000_01D62613.778669A0
Content-Type: text/html;
        charset="utf-8"
Content-Transfer-Encoding: base64

PGh0bWw+PGJvZHk+PHA+6L+Z5piv5Zyo5rWL6K+V5L2g55qE5biQ5oi36K6+572u5pe2IE1pY3Jv
c29mdCBPdXRsb29rIOiHquWKqOWPkemAgeeahOeUteWtkOmCruS7tuOAgg0KPC9wPjwvYm9keT48
L2h0bWw+

------=_NextPart_000_0000_01D62613.778669A0--
.
RETR 6
+OK 1199 octets
Received: by ajax-webmail-www.example.com (Coremail) ; Sat, 9 May 2020
 15:35:01 +0800 (GMT+08:00)
X-Originating-IP: [10.228.12.149]
Date: Sat, 9 May 2020 15:35:01 +0800 (GMT+08:00)
X-CM-HeaderCharset: UTF-8
From: test02@coremail.cn
To: test01@coremail.cn
Subject: awesome pop
X-Priority: 3
X-Mailer: Coremail Webmail Server Version XT5.0.8a build 20190308(983496cf)
 Copyright (c) 2002-2020 www.mailtech.cn 126com
Content-Type: multipart/alternative;
        boundary="----=_Part_5_1271853342.1589009701828"
MIME-Version: 1.0
Message-ID: <4d02717c.1.171f85bdbc6.Coremail.test02@coremail.cn>
X-Coremail-Locale: zh_CN
X-CM-TRANSID:AQAAfwAXM7olXbZeXAAAAA--.0W
X-CM-SenderInfo: hwhv3ims6f02phpdxzgofq/1tbiAQADCV0Y3LsAAwAIsi
X-Coremail-Antispam: 1Ur529EdanIXcx71UUUUU7IcSsGvfJ3GIAIbVAYFVCjjxCrMI
        AIbVAFxVCF77xC64kEw24lV2xY67C26IkvcIIF6IxKo4kEV4DvcSsGvfC2KfnxnUU==

------=_Part_5_1271853342.1589009701828
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

This is for pop test!
------=_Part_5_1271853342.1589009701828
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

This is for pop test!
------=_Part_5_1271853342.1589009701828--
.
RETR 4
+OK 6469 octets
Received: from TINY-DESKTOP (unknown [10.228.12.149])
        by www.example.com (Coremail) with SMTP id AQAAfwCngFa5lNFcYQAAAA--.16S2;
        Tue, 07 May 2019 22:22:50 +0800 (CST)
Date: Thu, 7 May 2020 14:22:46 +0800
From: test02 <test02@coremail.cn>
To: =?utf-8?Q?test01=40coremail.cn?= <test01@coremail.cn>
Message-ID: <305443E1-9258-4260-AA18-1A5CDFBD60EE@coremail.cn>
Subject: smtp test
X-Mailer: MailMasterPC/4.14.1.1004 (Windows 10 RS5)
X-CUSTOM-MAIL-MASTER-SENT-ID: 710FAD56-B1F1-48B7-B72F-543A5E51C5F2
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64
X-CM-TRANSID:AQAAfwCngFa5lNFcYQAAAA--.16S2
X-Coremail-Antispam: 1UD129KBjDUn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7v73
        VFW2AGmfu7bjvjm3AaLaJ3UjIYCTnIWjp_UUUol7kC6x804xWl14x267AKxVWUJVW8JwAF
        c2x0x2IEx4CE42xK8VAvwI8IcIk0rVWUJVWUGwAFIxvE14AKwVWUJVWUGwA2jI8I6cxK62
        vIxIIY0VWkZVCq3wA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK021l84ACjcxK6xII
        jxv20xvE14v26r1j6r1xM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r1j6r4UM28EF7xvwV
        C2z280aVAFwI0_Jr0_Gr1l84ACjcxK6I8E87Iv6xkF7I0E14v26r1j6r4UM2vYz4IE04k2
        4VAvwVAKI4IrM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVAqjxCE14ACF2xKxwAqx4
        xG6xAIxVCFxsxG0wAqx4xG6I80eVA0xI0YY7vIx2IE14AGzxvEb7x7Mc02F40Ex7xS62Iq
        YxC26I8Yz20kMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72
        CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7
        M4xvF2IEb7IF0Fy264kE64k0F24lFcxC0VAqx4xG64AKrs4lw4CE7480Y4vE14AKx2xKxV
        C2ax8xMxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAF
        wI0_JrI_JrWlx2IqxVCjr7xvwVAFwI0_Jr0_Jr4lx4CE17CEb7AF67AKxVWUJVWUXwCIc4
        0Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AK
        xVWUJVW8JwCI42IY6xAIw20EY4v20xvaj40_Wr1j6rW3Jr1lIxAIcVC2z280aVAFwI0_Jr
        0_Gr1lIxAIcVC2z280aVCY1x0267AKxVWUJVW8JwCE64xvF2IEb7IF0Fy7YxBIdaVFxhVj
        vjDU0xZFpf9x0zEzBTiUUUUU=
X-CM-SenderInfo: hwhv3ims6f02phpdxzgofq/

PGh0bWw+DQo8aGVhZD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSdDb250ZW50LVR5cGUnIGNvbnRl
bnQ9J3RleHQvaHRtbDsgY2hhcnNldD1VVEYtOCc+DQo8L2hlYWQ+DQo8Ym9keT4NCjxzdHlsZT4N
CiAgICBmb250ew0KICAgICAgICBsaW5lLWhlaWdodDogMS42Ow0KICAgIH0NCiAgICB1bCxvbHsN
CiAgICAgICAgcGFkZGluZy1sZWZ0OiAyMHB4Ow0KICAgICAgICBsaXN0LXN0eWxlLXBvc2l0aW9u
OiBpbnNpZGU7DQogICAgfQ0KPC9zdHlsZT4NCjxkaXYgc3R5bGUgPSAnZm9udC1mYW1pbHk65b6u
6L2v6ZuF6buRLFZlcmRhbmEsJnF1b3Q7TWljcm9zb2Z0IFlhaGVpJnF1b3Q7LFNpbVN1bixzYW5z
LXNlcmlmO2ZvbnQtc2l6ZToxNHB4OyBsaW5lLWhlaWdodDoxLjY7Jz4NCiAgICA8ZGl2ID48L2Rp
dj48ZGl2PgogICAgPGRpdj4KICAgICAgICA8c3Bhbj5zbXRwIHRlc3QKICAgICAgICA8L3NwYW4+
PC9kaXY+CiAgICA8ZGl2PgogICAgICAgIDxzcGFuPgogICAgICAgICAgICA8YnI+CiAgICAgICAg
PC9zcGFuPgogICAgPC9kaXY+CiAgICA8ZGl2IGlkPSJudGVzLXBjbWFjLXNpZ25hdHVyZSIgc3R5
bGU9ImZvbnQtZmFtaWx5Oiflvq7ova/pm4Xpu5EnIj4KICAgICAKICAgIDxkaXYgc3R5bGU9ImZv
bnQtc2l6ZToxNHB4OyBwYWRkaW5nOiAwOyAgbWFyZ2luOjA7bGluZS1oZWlnaHQ6MTRweDsiPgog
ICAgICAgIDxkaXYgc3R5bGU9InBhZGRpbmctYm90dG9tOjZweDttYXJnaW4tYm90dG9tOjEwcHg7
Ym9yZGVyLWJvdHRvbToxcHggc29saWQgI2U2ZTZlNjtkaXNwbGF5OmlubGluZS1ibG9jazsiPgog
ICAgICAgICAgICAgICAgICAgIDxhIGhyZWY9Imh0dHBzOi8vbWFhcy5tYWlsLjE2My5jb20vZGFz
aGktd2ViLWV4dGVuZC9odG1sL3Byb1NpZ25hdHVyZS5odG1sP2Z0bElkPTEmYW1wO25hbWU9dGVz
dDAyJmFtcDt1aWQ9dGVzdDAyJTQwY29yZW1haWwuY24mYW1wO2ljb25Vcmw9aHR0cHMlM0ElMkYl
MkZtYWlsLW9ubGluZS5ub3Nkbi4xMjcubmV0JTJGcWl5ZWxvZ28lMkZkZWZhdWx0QXZhdGFyLnBu
ZyZhbXA7aXRlbXM9JTVCJTIydGVzdDAyJTQwY29yZW1haWwuY24lMjIlNUQiIHN0eWxlPSJkaXNw
bGF5OmJsb2NrO2JhY2tncm91bmQ6I2ZmZjsgbWF4LXdpZHRoOiA0MDBweDsgX3dpZHRoOiA0MDBw
eDtwYWRkaW5nOjE1cHggMCAxMHB4IDA7dGV4dC1kZWNvcmF0aW9uOiBub25lOyBvdXRsaW5lOm5v
bmU7LXdlYmtpdC10YXAtaGlnaGxpZ2h0LWNvbG9yOnRyYW5zcGFyZW50Oy13ZWJraXQtdGV4dC1z
aXplLWFkanVzdDpub25lICFpbXBvcnRhbnQ7dGV4dC1zaXplLWFkanVzdDpub25lICFpbXBvcnRh
bnQ7Ij4KICAgICAgICAgICAgPHRhYmxlIGNlbGxwYWRkaW5nPSIwIiBzdHlsZT0id2lkdGg6IDEw
MCU7IG1heC13aWR0aDogMTAwJTsgdGFibGUtbGF5b3V0OiBmaXhlZDsgYm9yZGVyLWNvbGxhcHNl
OiBjb2xsYXBzZTtjb2xvcjogIzliOWVhMTtmb250LXNpemU6IDE0cHg7bGluZS1oZWlnaHQ6MS4z
Oy13ZWJraXQtdGV4dC1zaXplLWFkanVzdDpub25lICFpbXBvcnRhbnQ7dGV4dC1zaXplLWFkanVz
dDpub25lICFpbXBvcnRhbnQ7Ij4KICAgICAgICAgICAgICAgIDx0Ym9keSBzdHlsZT0iZm9udC1m
YW1pbHk6ICdQaW5nRmFuZyBTQycsICdIaXJhZ2lubyBTYW5zIEdCJywnV2VuUXVhbllpIE1pY3Jv
IEhlaScsICdNaWNyb3NvZnQgWWFoZWknLCAn5b6u6L2v6ZuF6buRJywgdmVyZGFuYSAhaW1wb3J0
YW50OyB3b3JkLXdyYXA6YnJlYWstd29yZDsgd29yZC1icmVhazpicmVhay1hbGw7LXdlYmtpdC10
ZXh0LXNpemUtYWRqdXN0Om5vbmUgIWltcG9ydGFudDt0ZXh0LXNpemUtYWRqdXN0Om5vbmUgIWlt
cG9ydGFudDsiPgogICAgICAgICAgICAgICAgICAgIDx0cj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDx0ZCB3aWR0aD0iMzgiIHN0eWxlPSJwYWRkaW5nOjA7IGJveC1zaXppbmc6IGJvcmRl
ci1ib3g7IHdpZHRoOiAzOHB4OyI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGlt
ZyB3aWR0aD0iMzgiIGhlaWdodD0iMzgiIHN0eWxlPSJ2ZXJ0aWNhbC1hbGlnbjptaWRkbGU7IHdp
ZHRoOiAzOHB4OyBoZWlnaHQ6IDM4cHg7IGJvcmRlci1yYWRpdXM6NTAlOyIgc3JjPSJodHRwczov
L21haWwtb25saW5lLm5vc2RuLjEyNy5uZXQvcWl5ZWxvZ28vZGVmYXVsdEF2YXRhci5wbmciPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDx0ZCBzdHlsZT0icGFkZGluZzogMCAwIDAgMTBweDsgY29sb3I6ICMzMTM1M2I7Ij4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2IHN0eWxlPSJmb250LXNpemU6IDE2cHg7
Zm9udC13ZWlnaHQ6Ym9sZDsgd2lkdGg6MTAwJTsgd2hpdGUtc3BhY2U6IG5vd3JhcDsgb3ZlcmZs
b3c6aGlkZGVuO3RleHQtb3ZlcmZsb3c6IGVsbGlwc2lzOyI+dGVzdDAyPC9kaXY+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8L3RkPgogICAgICAgICAgICAgICAgICAgIDwvdHI+CiAgICAg
ICAgICAgICAgICAgICAgICAgIDx0ciB3aWR0aD0iMTAwJSIgc3R5bGU9ImZvbnQtc2l6ZTogMTRw
eCAhaW1wb3J0YW50OyB3aWR0aDogMTAwJTsiPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
PHRkIGNvbHNwYW49IjIiIHN0eWxlPSJwYWRkaW5nOjEwcHggMCAwIDA7IGZvbnQtc2l6ZToxNHB4
ICFpbXBvcnRhbnQ7IHdpZHRoOiAxMDAlOyI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxkaXYgc3R5bGU9IndpZHRoOiAxMDAlO2ZvbnQtc2l6ZTogMTRweCAhaW1wb3J0YW50
O3dvcmQtd3JhcDpicmVhay13b3JkO3dvcmQtYnJlYWs6YnJlYWstYWxsOyI+dGVzdDAyQGNvcmVt
YWlsLmNuPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RkPgogICAgICAgICAg
ICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAgICAgPC90Ym9keT4KICAgICAgICAgICAg
PC90YWJsZT4KICAgICAgICA8L2E+CiAgICAgICAgPC9kaXY+CiAgICA8L2Rpdj4KICAgIDxkaXYg
c3R5bGU9ImZvbnQtc2l6ZToxMnB4O2NvbG9yOiNiNWI5YmQ7bGluZS1oZWlnaHQ6MThweDsiPgog
ICAgICAgIDxzcGFuPuetvuWQjeeUsTwvc3Bhbj4KICAgICAgICA8YSBzdHlsZT0idGV4dC1kZWNv
cmF0aW9uOiBub25lO2NvbG9yOiM0MTk2ZmY7cGFkZGluZzowIDVweDsiIGhyZWY9Imh0dHBzOi8v
bWFpbC4xNjMuY29tL2Rhc2hpL2RscHJvLmh0bWw/ZnJvbT1tYWlsODEiPue9keaYk+mCrueuseWk
p+W4iDwvYT4KICAgICAgICA8c3Bhbj7lrprliLY8L3NwYW4+CiAgICA8L2Rpdj4KIDwvZGl2Pgo8
L2Rpdj48IS0t8J+YgC0tPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+
.

Sending the NOOP command has no practical effect. It is mainly used to keep the data connection with the server without interruption.

NOOP
+OK core mail

We can also use the DELE command to delete the specified mail. After deletion, use LIST to view the effect:

DELE 4
+OK core mail
LIST
+OK 5 19099
1 7959
2 1199
3 6445
5 2297
6 1199
.

You can also use the RSET command to undo the deletion and use the LIST command to view the effect

RSET
+OK core mail
LIST
+OK 6 25568
1 7959
2 1199
3 6445
4 6469
5 2297
6 1199
.

Finally, use the QUIT command to disconnect and exit the system:

QUIT
+OK core mail
Connection closed by foreign host.

Keywords: SSL server wireshark

Added by benzrf on Fri, 25 Feb 2022 11:35:18 +0200