Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer?

On which port does the email travel? HTTP, SMTP, POP3?

1 Answer 1


Let us break this down into three parts:

  1. Between domains, the protocol is SMTP, which is essentially a relayed protocol. If SSL/TLS is not being used, a sniffer will detect anything. If SSL/TLS is being used, a packet sniffer will be able to know the from and to IP addresses, and any relay on the way would have to decrypt and then re-encrypt the email.

  2. If using POP/IMAP/SMTP from a thick client (e.g. Outlook) to any one of these services, the port numbers vary but there are well-known ones.

  3. If using the Web interface of these services, then the ports are 80 (HTTP) and/or 443 (HTTPS) from your user agent (browser) to the originating domain - (Google or Yahoo). There, the packets are de-crypted to clear-text and then optionally re-encrypted if the target domain or a relay supports SSL/TLS over SMTP. After that, the process reverses itself: If your target domain's user is also using a browser, then the reverse will happen and clear-text email stored on the target domain's mail server will be encrypted to HTTPS sent over client ports (random ports) to the end user.

In short,

  • if not using SSL/TLS, everything is visible.
  • if using SSL/TLS, everything is visible to the relays but not in transit.
  • port numbers may vary.
  • Thank you so much for your response. I want to ask you another question if possible. This morning, I was experimenting with a few keyloggers. Two of these keyloggers had an optiion to send the logs to an email account using a Gmail account provided by the user. Now let us say that when the keylogger sends the email, the user has a packet sniffer running and is not doing anything web-related (that is, web browser closed, no downloading etc). Will the packet sniffer be able to pick up this email? On what port should the packet sniffer listen?
    – Matthew
    Mar 27, 2013 at 16:01
  • @Matthew Yes, a packet sniffer will be able to pick this up. It might be an encrypted connection though, then you can't read it. The default port for this is 25, but any could theoretically be used. The browser or other programs do not need to be closed (though it helps for inexperienced users to find the packet).
    – Luc
    Mar 28, 2013 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .