This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can Wireshark monitor emails

0

i would like to know if wireshark can monitor email that pass through my network, store it and notify me. is wireshark for mac available

Also i would like to know if wireshark is a server-side or server-client side

thanks.

asked 09 Nov '15, 12:40

yhomiid's gravatar image

yhomiid
6224
accept rate: 0%

edited 09 Nov '15, 12:40


3 Answers:

0

Yes, it can, but in the form of network packets. You can reassemble them (manually) and store them. Notification - nope.

Wireshark is either side - doesn't matter if client, server or (best case) 3rd device in the middle.

answered 09 Nov '15, 15:05

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

0

i would like to know if wireshark can monitor email that pass through my network,

Yes.

store it

Yes, with some extra manual work

and notify me.

No. Wireshark is a network troublshooting tool, not a network monitoring tool.

is wireshark for mac available

Yes. https://www.wireshark.org/#download

Also i would like to know if wireshark is a server-side or server-client side

Not sure what you are asking for! Wireshark is a piece of software that can be installed on any supported OS. As such, it's neither client- nor server-side. It's just software that you can install on a client system and/or on a server system.

Regards
Kurt

answered 09 Nov '15, 15:06

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

0

i would like to know if wireshark can monitor email that pass through my network,

Its understanding of email is limited - it understands some e-mail protocols, and understands HTTP and HTTP2 so it can understand webmail to some degree, and understands some information about mail formats, but it's not designed as an e-mail monitoring program, so there's limits to what it can easily determine about the mail.

It's a passive sniffer program, so mail on your system doesn't pass through it, so it can't stop mail or modify it in flight, and if it can't keep up with network traffic, it won't see all the mail passing through your system.

store it

It's a sniffer, so what it captures is raw network traffic; that's what it stores, not e-mails.

and notify me.

It might be possible to write a Lua script that runs while Wireshark is running and sends notifications when it detects things in the packets it sees, but that would involve having the script look at raw network packet fields.

is wireshark for mac available

Yes, it runs on OS X, as well as a number of other OSes. The OS X versions are available from the Wireshark Web site.

Also i would like to know if wireshark is a server-side or server-client side

As it's a passive network sniffer, it can run on any machine that can see network traffic, whether it's the server, the client, or some third-party machine running in promiscuous or monitor mode, so the question doesn't apply. As I said above, it's not something that's in the data flow path for e-mail or any other form of network traffic - think of it as being like a phone tap where somebody can listen to your phone conversation.

answered 09 Nov '15, 18:29

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%