Our company wants to implement a service based on sniffing for security purposes, since we manage important information this requirement is imperative. The situation is as follows.

Everyone in the office uses a VPN for preventing external eavesdroppers to sniff in our network. Although, the company is looking forward to protect it self from the inside out, then if an employee sends a particular message containing certain key words an alarm should be sent to a particular Area. Then, is it possible to sniff on our own VPN to further increase security?

  • I am interested in your use of VPN here. What do you mean by "Everyone in the office uses a VPN"? Otherwise VPN is not a barrier to sniffing anything on your network.
    – schroeder
    Commented Jan 3, 2012 at 21:35
  • I don't understand the question. At some point the VPN must terminate in your office and be decrypted. It's at that point you would inspect the traffic. Larger issues such as "can the user VPN in, take a bunch of data, and then log off from the VPN and send it somewhere else?" seem more relevant because they would be totally missed by this "solution".
    – mpontillo
    Commented Jan 4, 2012 at 0:35
  • What you want to do is not clear. It sounds like you use a VPN to make a connection to the office network. You can sniff any traffic on your own network. The VPN is technically part of your network. Of course the data going to the VPN might be encrypted depending on the settings, I would hope thats the case, otherwise its sort of useless.
    – Ramhound
    Commented Jan 4, 2012 at 16:31
  • Sounds more like someone who wants to spy on someone's personal crap, or someone worried that they will be caught at work doing , well say goofing off, rather than an actual enterprise set up or else they he or she would already know this.
    – user24368
    Commented Apr 5, 2013 at 19:05

3 Answers 3


Although "sniffing" can be just about anything to anyone, I usually consider the term to represent low-level information discovery -- usually at layer 2 to layer 4. Your question, if I can interpret a little bit, appears to want to perform discovery at higher levels. Such sniffing is absolutely possible, but requires more work to piece together the low level protocols to build a cohesive data stream.

The class of protection you are seeking is called "Data Loss Prevention" or DLP. Such systems can be placed within the network or placed as agents on each individual machine. They will continuously scan data at rest and data in motion at high levels of abstraction.

(The fact that you have a VPN is not entirely relevant to the rest of your question, I don't believe (unless you do not control the VPN server). A VPN protects the information across an untrusted network. Perhaps this network is the public Internet, and perhaps it is a segment of an internal corporate network which processes sensitive information that needs to be separate and protected from other corporate networks. At the end of the day, the VPN traffic/data will be decrypted by the VPN server to perform actual, useful work. It is within that scope that you can embrace an in-network DLP solution -- or, you could deploy DLP agents on the individual machines -- or both.)


Have you looked at Data Loss Prevention (DLP) options? Symantec has a nice product.


What you describe is a e-mail content filter and not DLP. DLP is much wider approach, extremely expensive and because of that currently the first class buzzword of security salesmen. In contrast to that content filtering can be configured on various MTAs and you get it for free in most cases. Here is an example for Postfix.

E-mail content filtering does not depend on your network encryption, because it is done on the MTA. It works with IPsec encrypted internal networks and with L2TP encrypted external networks. But it requires that the mails are not encrypted.

If your user sends encrypted messages you have in general no chance to intercept the communication. This is one reason why some companies permit sending encrypted mails or encrypted attachments like encrypted ZIP files. Another reason is that it is not possible to perform virus checks on encrypted mails.

But there are solutions available to solve this problem. The first solution works with a master key, which gives the MTA a way to decrypt the encrypted e-mails. And the second is an encryption gateway, which does the encryption for the user, which means that the user does not need to encrypt and therefor is not allowed to encrypt.

  • I would hope anyone dealing with "important information" is encrypting their emails.
    – Ramhound
    Commented Jan 4, 2012 at 16:33
  • Something that is important is not necessarily private. Something that is important should be signed.
    – ceving
    Commented Jan 5, 2012 at 9:41
  • Hi @ceving - can I ask why you are deleting multiple posts that don't appear to have anything wrong with them?
    – Rory Alsop
    Commented Oct 26, 2012 at 18:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .