up vote 0 down vote favorite
share [g+] share [fb]

I'm looking for a way to intercept outgoing SMTP messages from a few users on my network. Sadly I'm dependent on an e-mail provider and can't set up my own e-mail server.

link|improve this question
You need clarify your meaning of "intercept". Are you wanting to record the traffic, or are you wanting to prevent it from leaving the network? – retracile Dec 15 '09 at 15:03
I have to save entire messages for further study. – DeeJay1 Dec 16 '09 at 9:21
feedback

2 Answers

up vote 0 down vote accepted

You need a certain amount of control over the network in order to intercept any traffic; what sort of control and what sort of hardware can make your job harder or easier.

A managed (even lightly managed, like a Netgear FS726T) switch with a monitor port will get you most of the way there, and Wireshark plugged into the monitor port watching for SMTP traffic from the needed IP addresses will get you the rest of the way.

Without a hardware monitoring solution, or access to one, you'll need to work on it with a more ...malware-esque solution on the individual computers, which I won't go into yet, but maybe post a little more about what tools you have available: What type of router are you using? Some of those will echo traffic. What type of switch? Is there a spare box around you can throw Wireshark on?

link|improve this answer
A managed switch and Wireshark will help the OP monitor SMTP traffic but will not help him intercept SMTP traffic. – joeqwerty Dec 15 '09 at 14:28
If you record the stream then apply a filter then save the stream, it's been intercepted, no? – chris Dec 15 '09 at 14:53
@chris: no, it's been copied but it hasn't been intercepted. In my opinion intercepting means to stop or divert the original email, not a copy of said email. – joeqwerty Dec 15 '09 at 21:08
@joeqwerty: I need a copy of said emails Sorry, English isn't my native language and I may have used the wrong word. @atroon: I can put something in place, but I think the solution should go under $1000 to be reasonable. – DeeJay1 Dec 16 '09 at 9:28
@joeqwerty: You're right, my interpretation of 'intercept' was to monitor and record, as in an intercepted broadcast vs. an intercepted postal letter. Thanks for the clarification, I should have been more careful in my definition of terms. @DeeJay1: Under $1000 should be dead easy in this case; a switch like the one I mentioned is about $300-400 (if you don't have one) and a spare box, well, could even be free. :) – atroon Dec 16 '09 at 16:33
feedback
up vote 4 down vote

Firstly - are you legally allowed to and even if you are most countries insist you let your staff know that this is going to happen, there's usually a period of time that has to go by between telling them and starting monitoring.

Secondly - the easiest way is to create your own MTA internally that allows for mail-snooping that just forwards on smtp to the usual provider. If you can't do this then wireshark will let you do that kind of thing but is a lot harder to do.

Are you sure you want to do this?

link|improve this answer
1  
As in my comment to atroon's answer, Wireshark will allow him to monitor SMTP traffic but will not help him intercept the traffic. – joeqwerty Dec 15 '09 at 14:29
good point, well made – Chopper3 Dec 15 '09 at 15:39
1. I am allowed, my users have signed proper papers before they were hired. 2. Sadly this isn't an option here as AFAIK it would included configuration changes on client computers. – DeeJay1 Dec 16 '09 at 9:24
Understood, just wanted you to be aware of the legal implications in your country - nobody likes getting fired :) – Chopper3 Dec 16 '09 at 10:02
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.