Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an SMTP relay (just an XP box with SMTP) on our network. It's hanging around because some legacy apps used to use it so send emails from code.

It hardly gets any traffic, I can see from the SMTP log that it's only used every few days, if that.

Before I turn it off, I want to track where the emails are coming from (I can see the originating server, but I want to be able to see the SMTP header to get sender, recipient and if possible the body.)

How can I do this over a long period of time? I thought about wireshark, but am planning on leaving it running for a couple of weeks. Is this manageable or is there a better solution?

share|improve this question
    
what smtp software is the xp box running? –  mtm Aug 17 '12 at 14:08
    
Read the email headers... by opening the emails? –  HopelessN00b Aug 17 '12 at 14:36
add comment

2 Answers 2

up vote 1 down vote accepted

I've no idea about wireshark + windows, but using linux + tcpdump (almost equivalent from what I've heard), I had no problem capturing traffic for a few days provided that there is :

  • Enough disk space
  • Not much traffic
  • Port (25) is specified so that captures dont grow too big.
share|improve this answer
    
I might be being thick here. . . I've set a capture filter (having removed all the others to 'smtp' (without quotes). However my capture still shows loads of traffic flowing. If I set the display fliter to smtp, I see just SMTP traffic. How do I ensure I only capture smtp so my capture file doesn't grow enormous? –  Ben Aug 17 '12 at 15:15
    
No idea sorry. With tcpdump it's "tcpdump -i eth0 -s 0 port 25". –  Eric DANNIELOU Aug 17 '12 at 15:36
    
No sweat - thanks anyway! –  Ben Aug 17 '12 at 15:36
    
isn't this a windows box? –  austin Aug 17 '12 at 19:33
    
@austin yes : That's why I said I had "no idea" –  Eric DANNIELOU Aug 17 '12 at 19:37
show 3 more comments

i know you said no wireshark but i think you should. simply add capture filters to your specific addresses that you know the email are originating from. you could also try and capture just X number of bytes to just attempt to get the header. check - capture filters

share|improve this answer
    
You could also apply a capture filter for just SMTP traffic. That should reduce the amount of traffic captured significantly. –  joeqwerty Aug 17 '12 at 14:38
    
Trying to do that, but struggling getting the capture filter to capture just smtp. Can do a display filter, but I assume that doesn't prevent the other packets being logged. –  Ben Aug 17 '12 at 15:19
    
well since very few hosts are relaying on this server, you probably know exactly which hosts are using this server. if that's the case, simply capture just those packets. that will cut your capture size down and then you can filter out SMTP. –  austin Aug 17 '12 at 19:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.