The SMTP TX now completes after the server response from DATA, not when
the client sends end of data. So the pcap_cnt for this test is now 53
instead of 51.
checks:
- filter:
+ requires:
+ min-version: 9
+ count: 1
+ match:
+ dest_ip: 74.53.140.153
+ dest_port: 25
+ email.attachment[0]: NEWS.txt
+ email.from: '"Gurpartap Singh" <gurpartap@patriots.in>'
+ email.status: PARSE_DONE
+ email.to[0]: <raj_deol2002in@yahoo.co.in>
+ event_type: smtp
+ pcap_cnt: 53
+ proto: TCP
+ smtp.helo: GP
+ smtp.mail_from: <gurpartap@patriots.in>
+ smtp.rcpt_to[0]: <raj_deol2002in@yahoo.co.in>
+ src_ip: 10.10.1.4
+ src_port: 1470
+ tx_id: 0
+# Pre-9 does not defer tx completion to the server response, so the
+# SMTP event lands two packets earlier. Remove when backported to 8.
+- filter:
+ requires:
+ lt-version: 9
count: 1
match:
dest_ip: 74.53.140.153