Patch by Luciano Bello for dsniff >= 2.4b1, which allows to distinguish between different POP versions. --- dsniff-2.4b1/decode.c 2007-08-11 18:43:41.000000000 -0300 +++ dsniff-2.4b1/decode.c.pop_version 2007-08-11 19:01:08.000000000 -0300 @@ -63,7 +63,8 @@ { "http", decode_http }, { "ospf", decode_ospf }, { "poppass", decode_poppass }, - { "pop", decode_pop }, + { "pop2", decode_pop }, + { "pop3", decode_pop }, { "nntp", decode_nntp }, { "smb", decode_smb }, { "imap", decode_imap }, --- dsniff-2.4b1/dsniff.services 2007-08-11 18:43:41.000000000 -0300 +++ dsniff-2.4b1/dsniff.services.pop 2007-08-11 19:00:21.000000000 -0300 @@ -10,8 +10,8 @@ ospf 89/ip http 98/tcp poppass 106/tcp -pop 109/tcp -pop 110/tcp +pop2 109/tcp +pop3 110/tcp portmap 111/tcp portmap -111/tcp portmap 111/udp