0

I'm looking for a way to intercept outgoing SMTP messages from a few users on my network. Sadly I'm dependent on an e-mail provider and can't set up my own e-mail server.

2
  • You need clarify your meaning of "intercept". Are you wanting to record the traffic, or are you wanting to prevent it from leaving the network?
    – retracile
    Dec 15, 2009 at 15:03
  • I have to save entire messages for further study.
    – DeeJay1
    Dec 16, 2009 at 9:21

2 Answers 2

0

You need a certain amount of control over the network in order to intercept any traffic; what sort of control and what sort of hardware can make your job harder or easier.

A managed (even lightly managed, like a Netgear FS726T) switch with a monitor port will get you most of the way there, and Wireshark plugged into the monitor port watching for SMTP traffic from the needed IP addresses will get you the rest of the way.

Without a hardware monitoring solution, or access to one, you'll need to work on it with a more ...malware-esque solution on the individual computers, which I won't go into yet, but maybe post a little more about what tools you have available: What type of router are you using? Some of those will echo traffic. What type of switch? Is there a spare box around you can throw Wireshark on?

5
  • A managed switch and Wireshark will help the OP monitor SMTP traffic but will not help him intercept SMTP traffic.
    – joeqwerty
    Dec 15, 2009 at 14:28
  • If you record the stream then apply a filter then save the stream, it's been intercepted, no?
    – chris
    Dec 15, 2009 at 14:53
  • @chris: no, it's been copied but it hasn't been intercepted. In my opinion intercepting means to stop or divert the original email, not a copy of said email.
    – joeqwerty
    Dec 15, 2009 at 21:08
  • @joeqwerty: I need a copy of said emails Sorry, English isn't my native language and I may have used the wrong word. @atroon: I can put something in place, but I think the solution should go under $1000 to be reasonable.
    – DeeJay1
    Dec 16, 2009 at 9:28
  • @joeqwerty: You're right, my interpretation of 'intercept' was to monitor and record, as in an intercepted broadcast vs. an intercepted postal letter. Thanks for the clarification, I should have been more careful in my definition of terms. @DeeJay1: Under $1000 should be dead easy in this case; a switch like the one I mentioned is about $300-400 (if you don't have one) and a spare box, well, could even be free. :)
    – atroon
    Dec 16, 2009 at 16:33
4

Firstly - are you legally allowed to and even if you are most countries insist you let your staff know that this is going to happen, there's usually a period of time that has to go by between telling them and starting monitoring.

Secondly - the easiest way is to create your own MTA internally that allows for mail-snooping that just forwards on smtp to the usual provider. If you can't do this then wireshark will let you do that kind of thing but is a lot harder to do.

Are you sure you want to do this?

4
  • 1
    As in my comment to atroon's answer, Wireshark will allow him to monitor SMTP traffic but will not help him intercept the traffic.
    – joeqwerty
    Dec 15, 2009 at 14:29
  • good point, well made
    – Chopper3
    Dec 15, 2009 at 15:39
  • 1. I am allowed, my users have signed proper papers before they were hired. 2. Sadly this isn't an option here as AFAIK it would included configuration changes on client computers.
    – DeeJay1
    Dec 16, 2009 at 9:24
  • Understood, just wanted you to be aware of the legal implications in your country - nobody likes getting fired :)
    – Chopper3
    Dec 16, 2009 at 10:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .