fw monitor help

[rn4it]

I need to confirm that our email is being encypted betwee us and a business partner. So in my captures I need to be able to view the message body of the emails. Here are the cmds I'm usings.

fw monitor -e "accept (dst = mailsvr ip or src = mailsvr ip);" -o smtp.txt
fw monitor -e "accept (dport = 25);" -o smtp.txt

I'm seeing the session build and tear down but not the data.

any ideas??

thanks
John

[Yasushi Kono]

Hello John,

you have to specify which portion of the packets to be included in your output file. So, for instance, by

fw monitor -x 40,400

which is the same as

fw monitor -l 400 -x 40

This expression means: the next 400 Bytes after leaving out the first 40 ones. I tried it with FTP without VPN or any encryption and you could read the payload of an ASCII document on the command line of the firewall.

I hope I could help you.

Kind regards,
Yasushi