i would like to know if wireshark can monitor email that pass through my network, store it and notify me. is wireshark for mac available Also i would like to know if wireshark is a server-side or server-client side thanks. asked 09 Nov '15, 12:40 yhomiid edited 09 Nov '15, 12:40 |
3 Answers:
Yes, it can, but in the form of network packets. You can reassemble them (manually) and store them. Notification - nope. Wireshark is either side - doesn't matter if client, server or (best case) 3rd device in the middle. answered 09 Nov '15, 15:05 Jasper ♦♦ |
Yes.
Yes, with some extra manual work
No. Wireshark is a network troublshooting tool, not a network monitoring tool.
Yes. https://www.wireshark.org/#download
Not sure what you are asking for! Wireshark is a piece of software that can be installed on any supported OS. As such, it's neither client- nor server-side. It's just software that you can install on a client system and/or on a server system. Regards answered 09 Nov '15, 15:06 Kurt Knochner ♦ |
Its understanding of email is limited - it understands some e-mail protocols, and understands HTTP and HTTP2 so it can understand webmail to some degree, and understands some information about mail formats, but it's not designed as an e-mail monitoring program, so there's limits to what it can easily determine about the mail. It's a passive sniffer program, so mail on your system doesn't pass through it, so it can't stop mail or modify it in flight, and if it can't keep up with network traffic, it won't see all the mail passing through your system.
It's a sniffer, so what it captures is raw network traffic; that's what it stores, not e-mails.
It might be possible to write a Lua script that runs while Wireshark is running and sends notifications when it detects things in the packets it sees, but that would involve having the script look at raw network packet fields.
Yes, it runs on OS X, as well as a number of other OSes. The OS X versions are available from the Wireshark Web site.
As it's a passive network sniffer, it can run on any machine that can see network traffic, whether it's the server, the client, or some third-party machine running in promiscuous or monitor mode, so the question doesn't apply. As I said above, it's not something that's in the data flow path for e-mail or any other form of network traffic - think of it as being like a phone tap where somebody can listen to your phone conversation. answered 09 Nov '15, 18:29 Guy Harris ♦♦ |