---
name: "mailsnarf"
section: "8"
platform: "linux"
package: "dsniff"
version: "2.4b1-34"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/mailsnarf"
---

# mailsnarf(8)

sniff mail messages in Berkeley mbox format

## NAME

mailsnarf - sniff mail messages in Berkeley mbox format

## SYNOPSIS

```

```

**mailsnarf** \[**-i** *interface* \| **-p** *pcapfile*\] \[\[**-v**\] *pattern \[expression*\]\]

## DESCRIPTION

**mailsnarf** outputs e-mail messages sniffed from SMTP and POP traffic in Berkeley mbox format, suitable for offline browsing with your favorite mail reader ([mail(1)](/mail/1.md), pine(1), etc.).

## OPTIONS

- **-i** *interface*

  Specify the interface to listen on.

- **-p** *pcapfile*

  Process packets from the specified PCAP capture file instead of the network.

- **-v**

  "Versus" mode. Invert the sense of matching, to select non-matching messages.

- *pattern*

  Specify regular expression for message header/body matching.

- *expression*

  Specify a [tcpdump(8)](/tcpdump/8.md) filter expression to select traffic to sniff.

## SEE ALSO

[dsniff(8)](/dsniff/8.md), [mail(1)](/mail/1.md), pine(1)

## AUTHOR

```
Dug Song <dugsong@monkey.org>
```