Extract POP3(1) Manual Page

Input

A stream containing a field of packet type.

Output

A record each time an POP3 command and a corresponding response have been paired.

The tool listens for POP3 handshakes on a given port and if on is found, starts extracting from the TCP session. Each time a command has been paired with a response an output record will be generated.

POP3 Port

Controls the port on which POP3 traffic is detected. The most common value (and the default) is 110, but in some scenarios, POP3 traffic may be exchanged on non-standard ports.

Message Contents

Controls which parts of POP3 messages are extracted. Setting it to Ignore ensures that no part of sent messages is extracted. Header specifies that the header of messages is to be extracted, and Full message specifies that the full messages including the header will be extracted.

Max message size

Limits the size of the extracted messages. The limit is in kilobytes.

Include password

If this option is enabled, POP3 account passwords will be extracted.