??E-mail??POP3????????

1
??????????
????????? ???
2006/06/29
2
??

• ?????
• ????????
• ?????????
• ??E-mail??POP3????????
• ????????

3
?????????????

• ?????(domain name)
• ?? tku.edu.tw, acad.tku.edu.tw, yahoo.com
• ????(host name)
• ?? www.tku.edu.tw, tw.yahoo.com
• ??(URL)
• ??http//www.tku.edu.tw
• http//spirit.tku.edu.tw8080/tku/index.jsp
• http//163.13.136.10/

4
???DNS

• DNS(??????)?Domain Name System???,??????????IP??
  ?IP??????? ?
• ????

.
.com
.tw
.net
.edu.tw
.com.tw
.org.tw
.tku.edu.tw
.ntu.edu.tw
.acad.tku.edu.tw
5
??????

• ???.com?.net?.org??????????http//www.networkso
  lutions.com?http//www.godaddy.com??????
• ???.com.tw?.net.tw?.org.tw?.tw??TWNIC?????????
  http//www.twnic.net.tw/newdn/name/name.htm
• ????????.tku.edu.tw,??OA?????????

6
??????????

• ??????????????????,???????????????
• ???????????????
• ??????????,?????????????,?????????????,?sexy?shopp
  ing ? crazy??
• ??????,??????,?????????
• TANet?????????????

7
????????(?)

• ????DNS,??????DNS?????????OA?????????
• ?? example.tku.edu.tw
• DNS???? dns.example.tku.edu.tw
• DNS IP 163.13.2.3
• ??? ???
• ???? ??2628

8
????????(?)

• ????DNS,??????????????????????????OA????????,?????
  ????
• ???? www.test.tku.edu.tw
• IP 163.13.2.3
• ??? ???
• ???? ??2628

9
??

• ?????
• ????????
• ?????????
• ??E-mail??POP3????????
• ????????

10
????????

• ????(log)??????????????????,????????????
• ??????,??log???????????
• ?????????
• UNIX /var/log
• Windows ???-gt??????-gt?????
• ???????
• ???????????????

11
???????? - ??

• ????
• Jun 27 001358 s90 cucipop20526 890350027
  163.13.142.12 0, 0 (0), 0 (0)
• Jun 27 001402 s90 cucipop20527
  authentication failure 490200200 61.228.115.83
• ??????
• Jun 27 145555 mailscan4 sendmail5382
  k5R0QF8X014325 toltlatifahgra_at_atbe ach.comgt,
  delay062907, xdelay000025, maileresmtp,
  pri7413936, relaym ail.atbeach.com.
  216.240.105.209, dsn4.2.0, statDeferred 450
  ltlatifahgra_at_atb each.comgt Recipient address
  rejected User unknown in local recipient table
• ??????
• 2006-06-08 110453 EDITUser wucf edit ipdata,
  IP163.13.212.119.
• 2006-06-19 005705 User 118216(unit_reg) login,
  toalloc, IP163.13.164.221.
• 2006-06-19 005719 ALLOCUser 118216()
  registered, IP163.013.164.117.
• 2006-06-19 005726 User 118216 logout.
• 2006-06-19 040003 ALLOC Clean expired data,
  ip163.013.166.107, durationcont.

12
???????? - ??

• IP?????????
• ??????????proxy?????
• ????????????

13
??????log??? - ??

• ???????log???????
• ??
• ????????????????
• ?????????
• ??
• ??????????????(rotate)?
• PHP??
• fplog fopen("/home/squid/logs/auth.log",
  "a")
• fwrite(fplog, date('Y-m-d His', time())."
  ".msg."\n")
• fclose(fplog)

14
??????log??? - ???

• ?????????????,???log??????,????????????????,??????
  ??????????????,????log?
• PHP??
• mysql mysql_pconnect(HOST, USER, PASSWORD)
• mysql_select_db(DATABASE, mysql)
• msg smart_quote(trim(msg))
• mysql_query("INSERT INTO log (date, msg) VALUES
  (NOW(), 'msg')", mysql)

15
??????log??? - ????

• ????????log?????????????,?Windows???????UNIX???sys
  log?
• ?? ???????log,??????????
• ?? log???????????,????????

16
??

• ?????
• ????????
• ?????????
• ??E-mail??POP3????????
• ????????

17
???????????

• ???????????
• ??????????(?Web Server??)
• ??????????(?Web Server??)
• ????????

18
???????????

• ??ping??,??????-gt??????-gt???????
• C\gt ping 163.13.1.60
• Pinging 163.13.1.60 with 32 bytes of data
• Reply from 163.13.1.60 bytes32 time1ms TTL63
• Reply from 163.13.1.60 bytes32 timelt1ms TTL63
• Ping statistics for 163.13.1.60
• Packets Sent 4, Received 4, Lost 0
  (0 loss),
• Approximate round trip times in milli-seconds
• Minimum 0ms, Maximum 1ms, Average 0ms
  (??!!)

19
???????????
C\gt ping 163.13.1.59 Pinging 163.13.1.59 with
32 bytes of data Request timed out. Request
timed out. Request timed out. Request timed
out. Ping statistics for 163.13.1.59
Packets Sent 4, Received 0, Lost 4 (100
loss), (??-???????)
20
???????????

• ??
• ?ping???IP?
• ?????????????????
• ?ping???(gateway) ?
• ????????????
• ??ping???DNS(163.13.1.60)?
• ??????????????
• ??????????????????

21
??????????(?Web??)

• ????????????
• ??????????
• ??proxy???
• ?proxy.tku.edu.tw, 3128 port????????
• ?proxy.edu.tw, 3128 port????????

22
??????????(?Web??)

• ??IE?????????
• ??-gt??????-gt??-gt?????HTTP????(????),?????

23
??????????(?Web??)

• ???????

24
??????????(?Web??)

• ????????,?????????????,????????index.htm?default.h
  tm????????

25
??????????(?Web??)

• ???????,??????????????????

26
??????????(?Web??)

• ???????

27
????????

• ??DNS??????
• C\gt nslookup www.tku.edu.tw
• Server tkurs1.tku.edu.tw
• Address 163.13.1.60
• Name www.tku.edu.tw
• Address 163.13.1.205
• ???????????DNS,??????????????IP,??IP????,???????
  ???? ?DNS?????
• ???Windows XP?DNS Cache ?

28
????????

• ??telnet?????80 port(??????port)??
• C\gt telnet dns.tku.edu.tw 80
• ???? dns.tku.edu.tw...??????????, ???? 80 ????
• (??80 port????,?????????)
• C\gt telnet www.tku.edu.tw 80
• GET / HTTP/1.1
• Host www.tku.edu.tw
• (?????Enter)
• HTTP/1.1 100 OK
• Content-Length 8036

29
????????
Content-Type text/html Server
Microsoft-IIS/6.0 X-Powered-By
ASP.NET ?.....lthtmlgt..... (Server??????html?)
q HTTP/1.1 400 Bad Request Content-Type
text/html Date Wed, 28 Jun 2006 034035
GMT Connection close Content-Length
35 lth1gtBad Request (Invalid Verb)lt/h1gt Connecti
on closed by foreign host. (????)
30
??

• ?????
• ????????
• ?????????
• ??E-mail??POP3????????
• ????????

31
????

• ??????POP3?????????????,??????????????
• ???????????
• OK Congratulations! (??)
• -ERR Invalid command (??-????)
• -ERR cucipop Invalid password or username
  (??-???????)
• ????????????
• OK aa's mailbox has 0 message(s) (??)
• -ERR aa logon failed (1332) at point 2 in PASS
  (??-??????)

32
POP3??????????????

• ??telnet??????
• C\gt telnet s91.tku.edu.tw 110
• ???? s91.tku.edu.tw...
• OK Cubic Circle's v1.31 1998/05/13 POP3 ready
  lt48390000b9eba044_at_s91.tku.edu.twgt
• user 491123456
• OK 491123456 selected
• pass x2468y
• OK Congratulations!
• quit
• OK Was it as good for you, as it was for me?
  (clean as a baby)
• ?????????
• (??!!)

33
POP3??????????????
C\gt telnet s91.tku.edu.tw 110 ????
s91.tku.edu.tw...??????????, ???? 110
???? (??server????????????????????) C\gt telnet
s91.tku.edu.tw 110 ???? s91.tku.edu.tw... OK
Cubic Circle's v1.31 1998/05/13 POP3 ready
lt48390000b9eba044_at_s91.tku.edu.twgt user
491123456 OK 491123456 selected pass aa -ERR
cucipop Invalid password or username (???????????
?)
34
POP3??????

• ????????????????
• ?????IP??(??)?????
• ?????????????????(????) ,?????????
• ???????????
• ??????????E-Mail?????????,?????????????
• ???????????????????

35
??

• ?????
• ????????
• ?????????
• ??E-mail??POP3????????
• ????????

36
?????????

• ?????????????????????,?????????????
• ??100KB?????
• ????? 100(KB) 2000(?) 200MB
• ???? 100(KB) 27,500(?) 2.75GB
• ????????? 100 68,000 6.8GB
• ??????????????1020 ?
• ??????????????

37
??????????????

• ?? http//dm.tku.edu.tw
• ??????????????????????????????E-Mail??,
  ?????????????
• ??????????????
• ????????,?????????????,?????,??????????

38
?????????????

• ????(????????5MB???)
• ???????????????
• ?????????SMTP Server???
• ????????????????
• ????????????????????,??????????????????,??????????
  ?????????

39

• Q A