Do you know any freeware software that I can install on our computers in order to silent log (to a folder, or forward to another email address) all received / sent email from that computer? The idea is to store all email into a folder and then parse the data to a archive.

I want to monitor POP3 and SMTP (since webmail is prohibited).

Best regards, Mike.


  • I want to install it on the clients (Windows XP Professional)
  • It'll need to run either on the server or the client - so listing what you've got for one or both of those will give you the best answers. – Kara Marfia Jun 23 '09 at 18:12
  • i would like to be able to run it on the client, as a service. – s.mihai Jun 23 '09 at 18:23
  • What kind of client? Windows XP, Linux, OSX? – Andy May Jun 23 '09 at 18:27
  • the clients are XP prof. – s.mihai Jun 23 '09 at 18:31

If the machines are all on one network, you're much better off doing it from a network tap. Why?

  • Users can't delete the software
  • Machines you don't know about are covered
  • User can't delete the logs
  • Disk crashes (on the clients) can't destroy your logs
  • Reinstalls can't destroy your logs
  • User's can't get by it with boot CDs or what-have-you


Using tcpdump to capture port 25/110/etc and then doing some post processing won't be hard at all.

  • I have little experience with TCPdump, but i am willing to get down and dirty. do you have any reference regarding this ? Though, i would like a install and forget app. – s.mihai Jun 23 '09 at 19:32
  • Using TCPdump isn't going to give you anything close to an "install and forget" application. You're going to end up with capture files that have raw network packets. If you want to re-assemble the captures into discrete email messages you will, at minimum, have to implement a TCP state machine (like the "follow this TCP stream" functionality in Wireshark) and a POP3 and SMTP layer-7 implementation. Capturing the traffic is easy-- getting that traffic made into discrete email messages won't be. – Evan Anderson Jun 23 '09 at 19:40
  • this is overkill. i just want to archive all sent email (one way or another). and i don't want it to be very easy for the user to bypass. a app running as a system service would be enough. but setting "automatic add BCC" in thunderbird, would be not OK, since they can just delete the e-mail address form the BCC field. – s.mihai Jun 23 '09 at 19:47
  • It would look like this: - Set up tcpdump to write out a file every N minutes/MB,/whatever - Run tcpflow on those files to give you individual streams (mail conversations) - Use tshark or something from dsniff to pull the data out of those streams - Use python/perl/what-have-you to dump the information you want This is, admittedly, some programming up front. You could also force people to use your SMTP server (firewall off ports 25 and 587) and use something like postfix's always_bcc feature. – Bill Weiss Jun 24 '09 at 0:16
  • Pretend that that had the correct markup for a post. – Bill Weiss Jun 24 '09 at 0:17

This is a function of your MTA. Almost all MTAs have a BCC function that will either forward copies or send emails of every email that passes through the system in question. Combine this with additional filtering and you have a basic audit system. The only time this doesn't work is when email is sent via direct connection (firewall NAT, proxy, etc.) to someone else's mail server.

Even if there isn't a MTA to be controlled, you can also find email clients that will send BCC to another address as part of its function. And there are usually local cached copies of email folders that can be retrieved and examined on the employee's computer.

Before you head out to do this, you will want to check the legality of this in your country and jurisdiction, as in some locations this is patently illegal and can result in rather nasty charges against you. Even in the USA, where data networks are pretty much the property of the employer and are controlled fiercely by them, there are still some states that require disclosure to employees that their activities can and will be monitored. Failing to disclose this usually doesn't result in criminal charges but can land you in a whopper of a civil suit for big $$$. Even though the data network belongs to the employer (and is treated as their property to be used as they like) there are cases where you can have invasion of the employee's privacy, and that's a path you don't want to go down without good reason. Consider this action carefully before you proceed.

If you end up in jail or a civil suit, well, you were warned. I'm not responsible for the results.


It sounds like you're trying to either (a) overengineer this, (b) get by on "the cheap", or (c) do something nasty to people who don't realize their traffic is being logged.

I seriously doubt that you're going to find an off-the-shelf solution for what you're looking for. Any commercial offering is going to be targeted at deployment at network choke-points, not at the edges of the network as you're describing. (You're looking, basically, for a distributed "Carnivore" email tap system.)

At a choke point, something like the "smtp-gated" proxy (see http://smtp-proxy.klolik.org/) could be used to log email messages (probably thru shimming its virus scanning interface). There's probably something suitably similiar for POP3, but I'm not coming up with anything. If you don't want to do it transparently then that opens up a lot more possibilities.

You could contract with a coder to write some client-side SMTP and POP3 proxy shims to do what you're looking for. To do it transparently would involve some fairly low-level mucking about in the network driver stack. To do it visibly, you'd just point your outgoing SMTP and POP3 at "localhost" and configure the proxy software with the appropriate POP3 and SMTP servers to connect to when connections come in to localhost. The local proxies would implement a POP3 and SMTP state machine that allowed for the capture of messages traversing the proxy.

If this is all being done for a single domain you might consider just signing up for email archiving services from somebody like Google Postini (http://www.google.com/postini/) and routing all your incoming and outgoing mail thru them, where it will be archived.

  • I have found several shareware apps that to this: ?<br> emailaddressmanager.com/monitoring.html or MailStore that i use as a proxy that logs and archives all sent/received proxy. <br> I need to use this in order to provide customers with transcripts of all e-mail conversations. – s.mihai Jun 23 '09 at 20:02


  • Archive all incoming / outgoing e-mail exchanges
  • Install on Workstations (Windows XP)

Sounds as if your target machines may be mobile, requiring the host based solution?

Archiving Email

Any mail server should be able to solve your archiving requirements (i.e. at least allow direction of carbon copy of email to some other internal mailbox.) For a Windows LAN there's plenty of Freeish Mail Servers and something like hMailserver might be able to server your needs. Bill Weiss has pointed out Postfix.

For a smallish network of 3 ~ 5 users (where you may not have control of your mail server) using a hosted service such as Gmail / Google Apps for business will give you your archiving requirements, with the flexibility that people can be connecting from anywhere. But it does come with a cost. Postini has a minimum of 100 users.

on Workstations

As pointed out by Avery Pain this is normally a 'feature' of your mail client (MTA.) For freeish clients, such as Mozilla Thunderbird this can be done with something like:

  • Blind Carbon Copy (in Account Settings | Copies & Folders);
  • Filter Rule to copy all incoming message to above bcc folder

But you know that users can change this. You could have a 'service' to checks the above settings and reverts to appropriate setting if changed ?

Encrypted Mail Traffic

If any of your workers use their Windows XP Pro machines outside the office, you should require that their mail be encrypted between the mail client and mail server. If you don't host your own mail server on your premises, you should at minimum require mail traffic be encrypted. Hosted services such as Gmail do this by default (both pop and smtp.)

Encrypted Mail Traffic definitely makes the 'listen in/monitor' concept a lot more challenging. Just watching traffic/dumping it to a file and reading it later (such as tcpdump) will result in beautifully encrypted data in your archives.

Value Proposition

Depending on how much/difficult it is to install a mail server on the premises (i.e. will it require a new machine, licenses etc.) it may be the most cost effective solution is to go for a hosted service which can be something like USD$10.00/month (Google) or USD$20 ~$50 /a year (pobox.com) an account. That's an annual cost as low as USD$200.00 a year to get all your archiving requirements!!

If you are providing the archiving service as part of a service/regulatory compliance then you may need to review the SLA with the hosting provider on privacy et. al.


If you use managed switches in your environment, you could use the port mirroring feature of your switch to capture all the traffic generated by that computer using a sniffer like Wireshark. You could limit the input capture to SMTP or POP3 and it would capture all the data transmitted over those ports.

If you are looking for something to install on the computer, look at products like Sonar which can do what you're looking for.

  • i am interested in capturing all email on a large number of pc's (3-5) and for a long period of time. using port mirroring is something i have used only for debugging. – s.mihai Jun 23 '09 at 19:02

I would suggest that the simplest way by far is to set up a proxy for both protocols and configure it to save a copy of every message. I don't know of a suitable product but am sure there are a number available.

If you install an application on each workstation you'll simply be creating a lot more work for yourself, with questionable results.

  • well... that proxy is what i need but i do not know any available options. if you know any please share. :) – s.mihai Jul 17 '09 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.