Extracts SMTP stream going both directions using Bro. Similar to "Follow TCP Stream" in Wireshark.

extract_smtp_stream.bro

event protocol_confirmation (c: connection, atype: Analyzer::Tag, aid: count)
{
  if ( atype == Analyzer::ANALYZER_SMTP )
  {
    local both_file = generate_extraction_filename(Conn::extraction_prefix, c, "both.dat");
    local both_f = open(both_file);
    set_contents_file(c$id, CONTENTS_BOTH, both_f);
  }
}