##Library required ##Variables defined ##Callback function ,when this function is called we check to make sure it has a data payload whether the payload contains the typical USER or PASS mail commands and if we detect an authentication string ,we print out the server we are sending it to and the actual data types of the packet . ##We added a filter that only includes the traffic destined for the common mail ports like "110 (POP3) ,143 (IMAP) ,25 (SMTP)" as well as we used the parameter "store" which is when set to '0' ensures that scapy isn't keeping the packets in memory. If we want to sniff for longer time then its a good idea to keep "store=0" so that it won't be consuming vast amounts of RAM. NOTE: execute this script with admin/root permissions Code repostory : sniffer_for_email_credentials Checkout some more hacking scripts SECURING SYSTEM ...