[Snort-users] Passive email archive

This is more of a general network sniffer inquiry than snort-specific, but I
thought it would still be appropriate for this list.

I'm trying to come up with an elegant solution to archiving corporate email
without mucking with the actual MTA's themselves. My first idea was to just
use a network sniffer to capture all the inbound and outbound mail traffic
with specific To and From fields. Capturing the traffic doesn't seem to be
the problem though. It's the storage part.

It's not very convienent to have the emails saved in a standard dumpfile as
packets. Too difficult to parse through the archive when you need to find a
specific email. Anyone have any ideas on how to get a snort/tcpdump/whatever
to save captured mail traffic as actual text mail files in a maildir type
format?

--
Miles Stevenson
miles@mstevenson.org
PGP FP: 035F 7D40 44A9 28FA 7453 BDF4 329F 889D 767D 2F63


-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users