fw monitor help

[rn4it]

Hi
I need to confirm that our email is being encypted betwee us and a business partner. So in my captures I need to be able to view the message body of the emails. Here are the cmds I'm usings.

fw monitor -e "accept (dst = mailsvr ip or src = mailsvr ip);" -o smtp.txt
fw monitor -e "accept (dport = 25);" -o smtp.txt

I'm seeing the session build and tear down but not the data.

any ideas??

thanks
John

 

[desperado618]

fw monitor only scans the information needed for security scanning. I would try tcpdump on the ingress and egress interfaces. Use the -s 1500 -vv switches to get the whole packet

http://www.NetLeets.com

IT Security news and information
In plain English