MAILSNARF(8)

💌 MAILSNARF 💌

okay bestie, so this one's mailsnarf, and it lives in section 8 of the System Manager's Manual — yes, the big scary admin section, don't be intimidated, she's sweet actually 🎀

✨ NAME ✨

mailsnarf</purole> — sniff mail messages in Berkeley mbox format 💖

✨ SYNOPSIS ✨

mailsnarf [-i interface | -p pcapfile] [[-v] pattern [expression]]

🌸 DESCRIPTION 🌸

okay so picture this: mailsnarf literally outputs e-mail messages sniffed from SMTP and POP traffic in Berkeley mbox format. and why do we care?? because that format is chef's kiss — it's suitable for offline browsing with your favorite mail reader (mail(1), pine(1), etc.) 🦋

it's giving "dump it in a file and read it later like a little detective" energy, ngl. main character forensics. 👑

💅 OPTIONS 💅

• -i interface — specify the interface to listen on. that's it, that's the vibe. pick your network card, queen 🌈
• -p pcapfile — process packets from the specified PCAP capture file instead of the network. so if you already saved the tea earlier, you can sip it now 🍓
• -v — "Versus" mode. it inverts the sense of matching, to select non-matching messages. so like, everything EXCEPT the thing. iconic behavior honestly 💅
• pattern — specify regular expression for message header/body matching. regex girlies rise up 😭
• expression — specify a tcpdump(8) filter expression to select traffic to sniff. yes, we're borrowing tcpdump's whole filter language, we're fancy like that ✨

🫶 quick reminder bestie: -i and -p are an either/or situation (that's what the | in the synopsis is telling you), and -v only does its little flip when it's hanging out with a pattern.

🔥 SEE ALSO 🔥

• dsniff(8)
• mail(1)
• pine(1)

👑 AUTHOR 👑

Dug Song <dugsong@monkey.org> 💜

and that's the whole page, no cap 💀✨ mailsnarf(8), straight outta the System Manager's Manual — go forth and browse your snarfed mail in peace, bestie 🧚💖