How to Read Email Messages in Transit

Email messages can be intercepted and read in transit over a LAN by an administrator.

Network and mail server administrators sometimes have legitimate reasons to trace email messages on their network while they are in transit; to ensure proper operation of the mail server and timely receipt of messages by end users. With the proper usernames and passwords, administrators can review email messages being held by the server before they are picked up by the user or can see email messages in transit on the local area network.

Things You'll Need

• Administrative access to the mail server
• Administrative access to the local area network

Instructions

Mail Server Queues

1. Log into the mail server handling email for the user whose email you wish to monitor with your administrative username and password.

2. Check the queue of incoming messages that are being held for that user. These will be a combination of new messages that remain unread and older messages that the user has left on the server.

3. Review the master queue of incoming messages that remain to be processed by the mail server. Under proper operation, this queue will rapidly be processed to distribute messages to individual mailboxes, but a mail server error may cause messages to back up in this queue.

Network Traffic

1. Install a network monitoring tool on a computer on the network you wish to monitor. One such option is the dsniff package of tools for Unix and Windows, which includes the mailsnarf application for network email monitoring.

2. Activate your network monitoring tool. Mailsnarf operates by selecting a network interface (i.e., your Ethernet port or wireless connection) and will store all email messages transmitted by SMTP or POP over that interface. Any computers sending or receiving email on your local subnet will broadcast this information to your port.

3. Review transmitted messages with any mbox-compliant email program, such as pine or elm.

Tips & Warnings

• These tools, if used inappropriately on a private network, can break federal laws against hacking computer networks. Extreme care should be taken to ensure that they are only used on networks to which you have legitimate administrative access.

References

• monkey.org: dsniff
• IBM: On the Lookout for dsniff: Part 1
• Windows IT Pro: Think You're Safe from Sniffing?
• Iron Geek: Manual Reference Page - Mailsnarf