Getting Mail stats from a Linux gateway

ALInux · 06-05-2009, 03:39 AM

Hi all
I got 50 users on my LAN and an external email server for the company domain...however the same external mail server is used by other branches...I want to know email statistics for my branch..is there some application I can install on my linux gateway to know how much amail traffic is coming in and going out of network......with alisting of emails if possible...this is plain old pop3 for incoming emails and smtp at port 25 for outgoing emails.
Thanks.

farslayer · 06-05-2009, 08:19 AM

Hmm take a look at untangle. You can set it up on a Separate PC with 2 NICS as a transparent bridge, then let all the network traffic flow through it, it can provide just statistics if that is all you want.

http://www.untangle.com/

You can use the protocol module to LOG all POP, SMTP, or IMAP requests that pass through the system.
Plus you'll have additional spam, antivirus, and phishing email blocking capabilities if you decide to implement those modules..

This is one way to 'skin the cat' I'm sure there are other methods as well, but this one is pretty simple to implement and was put together very well.

ALInux · 06-05-2009, 08:55 AM

Hi
Thanks for the hint, I am running a debian box with CBQ /Firewall scripts that I spent a long time configuring. However I do have a transparent proxy running. How could this help me ?

I was thinking about something drastic such as tcpdump and then analysis.

Regards

farslayer · 06-05-2009, 12:44 PM

Sorry I meant bridge not proxy.. my bad.
That error aside, you could look at the capabilities in untangles Protocol Control, then use the same Open Source apps on your system..

http://wiki.untangle.com/index.php/Protocol_Control

Quote:

Protocol Control uses an open-source tool, L7-filter. Protocol Control blocks and logs well-known protocols from entering or leaving your protected network

no need to block, just enable logging for the protocol you want.
http://l7-filter.sourceforge.net/

Quote:

L7-filter is a classifier for Linux's Netfilter that identifies packets based on application layer data. It can classify packets as Kazaa, HTTP, Jabber, Citrix, Bittorrent, FTP, Gnucleus, eDonkey2000, etc., regardless of port. It complements existing classifiers that match on IP address, port numbers and so on.

Thanks to our sponsor: Don't Pay For Protection: Untangle, The Open Source Network Gateway

Our intent is for l7-filter to be used in conjunction with Linux QoS to do bandwith arbitration ("packet shaping") or traffic accounting.

I just suggested Untangle because the system was put together and integrated nicely. it is a great reference for the varios apps they use though
See Application Quick Links http://wiki.untangle.com/index.php/Main_Page

Just an option