how can I capture an outgoing or incoming email by the emailadress?

thanks

asked 26 Nov '10, 06:25

kurtw's gravatar image

kurtw
1112
accept rate: 0%

I don't think you can do it easily w/o resorting to a complicated capture filter that looks for specific characters at certain offsets. And that won't even work reliably unless the emails are being sent individually.

(26 Nov '10, 09:08) hansangb

You could just capture all the email based on the TCP port used and then apply a display filter such as:

frame contains "name@domain.com"

or use

frame contains "userid"
link

answered 27 Nov '10, 14:31

lchappell's gravatar image

lchappell ♦
1.1k2726
accept rate: 8%

I had assumed the OP couldn't contend with the main SMTP feed's volume but I guess I could be wrong. I should stop thinking that everyone has to deal with massive scaling problems! :)

(27 Nov '10, 18:25) hansangb

Capturefilter I use: tcp port 110 or tcp port 25 or tcp port 143

Displayfilter I use: imf.from contains "email@mail.com" or imf.to contains "email@mail.com" or imf.sender contains "email@mail.com"

How can I export the filtered Emails to separatly files?

thanks k.w.

link

answered 01 Dec '10, 01:02

kurtw's gravatar image

kurtw
1112
accept rate: 0%

edited 01 Dec '10, 01:03

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×65

Asked: 26 Nov '10, 06:25

Seen: 7,049 times

Last updated: 01 Dec '10, 01:03

powered by OSQA