dport seq ack dataofs reserved flags window chksum urgptr options etlservicemgr [('nop'none)('nop'none)('timestamp'( ))none how incredibly easy was thatwe can see that when the first packet was received on the networkour callback function used the built-in function packet show(to display the packet contents and to dissect some of the protocol information using show(is great way to debug scripts as you are going along to make sure you are capturing the output you want now that we have our basic sniffer runninglet' apply filter and add some logic to our callback function to peel out email-related authentication strings from scapy all import our packet callback def packet_callback(packet)if packet[tcppayloadmail_packet str(packet[tcppayloadif "userin mail_packet lower(or "passin mail_packet lower()print "[*server%spacket[ipdst print "[*%spacket[tcppayload fire up our sniffer sniff(filter="tcp port or tcp port or tcp port ",prn=packet_ callback,store= pretty straightforward stuff here we changed our sniff function to add filter that only includes traffic destined for the common mail ports (pop ) (imap)and smtp ( we also used new parameter called storewhich when set to ensures that scapy isn' keeping the packets in memory it' good idea to use this parameter if you intend to leave long-term sniffer running because then you won' be consuming vast amounts of ram when our callback function is calledwe check to make sure it has data payload and whether the payload contains the typical user or pass mail commands if we detect an authentication stringwe print out the server we are sending it to and the actual data bytes of the packet