Ask Your Question
0

Unable to see SMTP traffic after getting new laptop

asked 2021-01-18 22:46:49 +0000

kb gravatar image

I was always able to scan for SMTP traffic when troubleshooting a MFP scanning to email issue on my laptop when using a HUB or Port mirrored switch. I then got a new laptop and now I am unable to see SMTP traffic when trying to scan to email from an MFP. I can still see everything else, ICMP, SMB, TCP and all else. When I try to scan to an email I cant see any DNS, SMTP, TLS or anything. It's as if nothing happened at all but the scan successfully sends to an email so I know it passed through the network. Anyone have any idea why?

edit retag flag offensive close merge delete

Comments

What operating system did the old laptop run, and what operating system does the new laptop run?

What network interfaces (Wi-Fi, Ethernet, mobile phone modem, etc.) did the old laptop have, and what network interfaces does the new laptop have?

Guy Harris gravatar imageGuy Harris ( 2021-01-18 22:51:45 +0000 )edit

Sorry I'm doing three things at once and I keep messing up my reply. Both were Windows 10 but the old laptop was upgraded from Windows 7. Both laptops as far as I can remember (the old laptop is gone now) have the same interfaces. Ethernet and a wireless card.

kb gravatar imagekb ( 2021-01-18 23:04:25 +0000 )edit

So are you capturing on Ethernet or on Wi-Fi? From "when using a HUB or Port mirrored switch" it sounds as if it'd be Ethernet.

Guy Harris gravatar imageGuy Harris ( 2021-01-20 03:30:13 +0000 )edit

Do you mean you see the ICMP and SMB traffic that comes from / goes through the IP address of your MFP device in your capture, but not the SMTP traffic? In this case I would guess that your capture setup is fine, and a kind of new installed antivirus-firewall-proxy-ips-vpn-solution is blocking the SMTP traffic before it reaches the capture driver. Or you've just disabled the SMTP protocol. Open the enabled/disabled protocol dialog (CTRL+SHIFT+E) and search for SMTP.

If you mean that you can capture ICMP and SMB in generally, I would suggest to check your capture setup. Start a capture and send an ICMP request to your MFP device from another PC. Do you see the ICMP request and response in the capture?

JasMan gravatar imageJasMan ( 2021-01-22 22:31:43 +0000 )edit

It was the anti virus! I disabled it and magically all SMTP traffic showed up. Thank you very much JasMan!

kb gravatar imagekb ( 2021-03-24 23:43:38 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-03-24 23:44:16 +0000

kb gravatar image

It was the anti virus! I disabled it and magically all SMTP traffic showed up. Thank you very much JasMan!

edit flag offensive delete link more

Comments

And for reference, what was the AV program that caused the issue?

grahamb gravatar imagegrahamb ( 2021-03-25 08:29:02 +0000 )edit

Symantec Endpoint Protection.

kb gravatar imagekb ( 2021-03-26 16:49:43 +0000 )edit

You should report this to the npcap folks over at https://github.com/nmap/npcap/issues, I don't know if they can do anything about it though.

grahamb gravatar imagegrahamb ( 2021-03-26 17:42:32 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-01-18 22:46:49 +0000

Seen: 122 times

Last updated: Mar 24