Thanks Chad for your advice. But it leads me to another question:
If I want to observe the complete Process of Mail sending or one particular message. From the beginning of the Handshake up to the successfull SMTP-Quit, Are they all running under the same [PID:VTID-PTID] Identifier?