I'm so sorry , I think my example was to short , so I put the complete example here
Sat 2006-03-18 00:00:27: Session 9991; child 3
Sat 2006-03-18 00:00:27: [9991:3] receive POP [192.168.0.1 : 3486]
Sat 2006-03-18 00:00:27: [9991:3] --> +OK abc.com.cn POP MDaemon 7.1.2 ready <MDAEMON-F200603180000.AA002746MD4560@abc.com.cn>
Sat 2006-03-18 00:00:27: [9991:3] <-- USER peng.chen
Sat 2006-03-18 00:00:27: [9991:3] --> +OK peng.chen...
Sat 2006-03-18 00:00:27: [9991:3] <-- PASS ******
Sat 2006-03-18 00:00:27: [9991:3] --> +OK
peng.chen@abc.com.cn
Sat 2006-03-18 00:00:27: [9991:3] <-- STAT
Sat 2006-03-18 00:00:27: [9991:3] --> +OK 0 0
Sat 2006-03-18 00:00:27: [9991:3] <-- QUIT
Sat 2006-03-18 00:00:27: [9991:3] --> +OK
peng.chen@abc.com.cn abc.com.cn POP
Sat 2006-03-18 00:00:27: [9991:3] POP connect finish
Sat 2006-03-18 00:00:27: ----------
Sat 2006-03-18 00:00:27: Session 9992; child 6
Sat 2006-03-18 00:00:27: [9991:3] receive POP [202.201.222.11:3486]
Sat 2006-03-18 00:00:27: [9991:3] --> +OK abc.com.cn POP MDaemon 7.1.2 ready <MDAEMON-F200603180000.AA002746MD4560@abc.com.cn>
Sat 2006-03-18 00:00:27: [9991:3] <-- USER yi.yi
Sat 2006-03-18 00:00:27: [9991:3] --> +OK yi.yi...
Sat 2006-03-18 00:00:27: [9991:3] <-- PASS ******
Sat 2006-03-18 00:00:27: [9991:3] --> +OK
yi.yi@abc.com.cn
Sat 2006-03-18 00:00:27: [9991:3] <-- STAT
Sat 2006-03-18 00:00:27: [9991:3] --> +OK 0 0
Sat 2006-03-18 00:00:27: [9991:3] <-- QUIT
Sat 2006-03-18 00:00:27: [9991:3] --> +OK
yi.yi@abc.com.cn abc.com.cn POP
Sat 2006-03-18 00:00:27: [9991:3] POP connect finish
Sat 2006-03-18 00:09:16: Session 30; child 1; thread 1380
Sat 2006-03-18 00:09:15: [30:1] receive SMTP from [222.111.212.33 : 2765] connect
Sat 2006-03-18 00:09:15: [30:1] --> 220 abc.com.cn ESMTP MDaemon 7.1.2; Sat, 18 Mar 2006 00:09:15 +0800
Sat 2006-03-18 00:09:16: [30:1] <-- EHLO hfdfgrt.net
Sat 2006-03-18 00:09:16: [30:1] Performing lookup on hfdfgrt.net (looking for 222.111.212.33)
Sat 2006-03-18 00:09:16: [30:1] unknown Domain
Sat 2006-03-18 00:09:16: [30:1] --> 250-abc.com.cn Hello hfdfgrt.net, nice to meet you
Sat 2006-03-18 00:09:16: [30:1] --> 250-ETRN
Sat 2006-03-18 00:09:16: [30:1] --> 250-AUTH=LOGIN
Sat 2006-03-18 00:09:16: [30:1] --> 250-AUTH LOGIN CRAM-MD5
Sat 2006-03-18 00:09:16: [30:1] --> 250-8BITMIME
Sat 2006-03-18 00:09:16: [30:1] --> 250-STARTTLS
Sat 2006-03-18 00:09:16: [30:1] --> 250 SIZE 10000000
Sat 2006-03-18 00:09:16: [30:1] <-- RSET
Sat 2006-03-18 00:09:16: [30:1] --> 250 seset **
Sat 2006-03-18 00:09:16: [30:1] <-- MAIL FROM:<fdfers4@hfdfgrt.net>
Sat 2006-03-18 00:09:16: [30:1] Performing lookup on hfdfgrt.net (looking for 222.111.212.33)
Sat 2006-03-18 00:09:16: [30:1] *****************
Sat 2006-03-18 00:09:16: [30:1] --> 250 <fdfers4@hfdfgrt.net> ,
Sat 2006-03-18 00:09:16: [30:1] <-- RCPT TO:<qzzhang@abc.com>
Sat 2006-03-18 00:09:16: [30:1] ****************
Sat 2006-03-18 00:09:16: [30:1] --> 550 <qzzhang@abc.com>,
Sat 2006-03-18 00:09:16: [30:1] <-- QUIT
Sat 2006-03-18 00:09:16: [30:1] --> 221 see you
Sat 2006-03-18 00:09:16: [30:1] SMTP finish
Sat 2006-03-18 00:09:16: ----------
I want the Session result is not SMTP and not the 202.201.222.11 , like this
Sat 2006-03-18 00:00:27: Session 9991; child 3
Sat 2006-03-18 00:00:27: [9991:3] receive POP [192.168.0.1 : 3486]
Sat 2006-03-18 00:00:27: [9991:3] --> +OK abc.com.cn POP MDaemon 7.1.2 ready <MDAEMON-F200603180000.AA002746MD4560@abc.com.cn>
Sat 2006-03-18 00:00:27: [9991:3] <-- USER peng.chen
Sat 2006-03-18 00:00:27: [9991:3] --> +OK peng.chen...
Sat 2006-03-18 00:00:27: [9991:3] <-- PASS ******
Sat 2006-03-18 00:00:27: [9991:3] --> +OK
peng.chen@abc.com.cn
Sat 2006-03-18 00:00:27: [9991:3] <-- STAT
Sat 2006-03-18 00:00:27: [9991:3] --> +OK 0 0
Sat 2006-03-18 00:00:27: [9991:3] <-- QUIT
Sat 2006-03-18 00:00:27: [9991:3] --> +OK
peng.chen@abc.com.cn abc.com.cn POP
Sat 2006-03-18 00:00:27: [9991:3] POP connect finish
Sat 2006-03-18 00:00:27: ----------
Thanks