Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an SMTP relay (just an XP box with SMTP) on our network. It's hanging around because some legacy apps used to use it so send emails from code.

It hardly gets any traffic, I can see from the SMTP log that it's only used every few days, if that.

Before I turn it off, I want to track where the emails are coming from (I can see the originating server, but I want to be able to see the SMTP header to get sender, recipient and if possible the body.)

How can I do this over a long period of time? I thought about wireshark, but am planning on leaving it running for a couple of weeks. Is this manageable or is there a better solution?

share|improve this question
what smtp software is the xp box running? – Matt Aug 17 '12 at 14:08
Read the email headers... by opening the emails? – HopelessN00b Aug 17 '12 at 14:36
up vote 1 down vote accepted

I've no idea about wireshark + windows, but using linux + tcpdump (almost equivalent from what I've heard), I had no problem capturing traffic for a few days provided that there is :

  • Enough disk space
  • Not much traffic
  • Port (25) is specified so that captures dont grow too big.
share|improve this answer
I might be being thick here. . . I've set a capture filter (having removed all the others to 'smtp' (without quotes). However my capture still shows loads of traffic flowing. If I set the display fliter to smtp, I see just SMTP traffic. How do I ensure I only capture smtp so my capture file doesn't grow enormous? – Ben Aug 17 '12 at 15:15
No idea sorry. With tcpdump it's "tcpdump -i eth0 -s 0 port 25". – user130370 Aug 17 '12 at 15:36
No sweat - thanks anyway! – Ben Aug 17 '12 at 15:36
isn't this a windows box? – au_stan Aug 17 '12 at 19:33
@austin yes : That's why I said I had "no idea" – user130370 Aug 17 '12 at 19:37

i know you said no wireshark but i think you should. simply add capture filters to your specific addresses that you know the email are originating from. you could also try and capture just X number of bytes to just attempt to get the header. check - capture filters

share|improve this answer
You could also apply a capture filter for just SMTP traffic. That should reduce the amount of traffic captured significantly. – joeqwerty Aug 17 '12 at 14:38
Trying to do that, but struggling getting the capture filter to capture just smtp. Can do a display filter, but I assume that doesn't prevent the other packets being logged. – Ben Aug 17 '12 at 15:19
well since very few hosts are relaying on this server, you probably know exactly which hosts are using this server. if that's the case, simply capture just those packets. that will cut your capture size down and then you can filter out SMTP. – au_stan Aug 17 '12 at 19:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.