Forensics · Frame-by-Frame Protocol Inspection

Forensic Incident Replay

Step-by-step wire analysis of in-path STARTTLS stripping observed during SMTP transit.

Capture Source:corpus/scenarios/stripped.pcap (Benchmark Scenario)

Ingest Custom PCAP →

Port 25 SMTP Transit Chain

Frame #4 of 6 · Offset 0x00004F2A · 00:00.140

Sender MTA (Client)mail.corp.net198.51.100.10:48210Grade A- (88/100)

Adversary In-Path Proxyrelay-gw.partner.net203.0.113.88:25STRIPPED CLEARTEXT

Destination MX Gatewaymx1.partner.net198.51.100.14:25ESMTP Postfix 3.7

Direction: Destination → ClientProtocol: SMTP / MITM

Wire Payload:250-PIPELINE (STARTTLS REMOVED)

ADVERSARY MODIFIED IN-FLIGHT

Protocol Walkthrough

Step 4 of 6: CRITICAL: STARTTLS STRIPPED

CRITICAL INCIDENT: The destination server legitimately offered STARTTLS encryption support. However, Hop 2 is an active adversary sitting directly on the transit link. The attacker intercepted the packet in mid-transit, deleted '250-STARTTLS', recalculated the TCP checksum, and forwarded the modified packet to our server. Our mail server was deceived into assuming encryption is not supported.

Frame 4 of 6 · 00:00.140

Speed:

In-Path Wire Tampering Evidence DiffRule: SMS-ENF-002

1. Server Sent from Port 25:

250-STARTTLS
250-PIPELINE
250-SIZE 3588000
250 8BITMIME

2. Client Received After Hop 2 Relay:- 250-STARTTLS (STRIPPED)

250-PIPELINE
250-SIZE 3588000
250 8BITMIME

Frame #4 Technical SummaryVULNERABILITY

CRITICAL: STARTTLS STRIPPED

Server 250 response intercepted. Adversary in the middle strips 250-STARTTLS keyword before forwarding to client.

Rule Citation: SMS-ENF-002

Active downgrade attack suppresses encryption opportunity, tricking sending MTA into sending in unencrypted plaintext.

Source Socket:Hop 2 (Adversary MITM Proxy 203.0.113.88)

Destination Socket:198.51.100.10:48210 (Client MTA)

Raw Wire Frame (Offset 0x00004F2A)Port 25

Hex Byte Stream:

32 35 30 2d 50 49 50 45 4c 49 4e 45 0d 0a 32 35 30 2d 53 49 5a 45 20 33 35 38 38 30 30 30 0d 0a

Decoded ASCII Stream:

250-PIPELINE 250-SIZE 3588000 [STARTTLS REMOVED BY MITM PROXY]