Q:

Intercepting and analyzing all email traffic in a network

We are building a network security solution for email protection in large organizations.
Our final goal is:
Intercepting all the emails that are entering the organization, scanning the email's attachments, in case everything is fine let the email continue to its destination, else block the email.
We specialize in scanning the email, and we are currently unsure what would be the best solution for intercepting all the emails.
We would be more than happy receiving information regarding this problem (key words ? Open source projects ?).
We believe our solution is kinda similar to IDS/IPS, but still don't understand how would email interception be done.
Existing solutions like Wireshark are able to intercept emails, but like I said, we need to intercept ALL the incoming emails of an organization, is Wireshark scalable for such a task ?
Thanks a lot,
Michael.

A:

Wireshark only listens to what is going in the network now, it won't help you to block said traffic. Wireshark doen't suited to do 24/7 capturing well. This is debug tool, it is used to help administrators to see why something not working. 
There are better solutions to redirect a copy of traffic to analyse things, but still you'll not be able to block current traffic. Say you found a virus and, well, the fact you have a copy of the traffic means that virus already made its way to client machine. This is an IDS way.
You have to be main-in-the-middle to do prevention and to be IPS. Your software should appear as valid server to clients, and understanding where they want to go, go there and appear as valid client to that server.
So, when your router sees connection to port 143 (IMAP) into internet, it will redirect packets to your filtering box. That box will reply "* OK ready", i.e. pretend it is an IMAP server, while making connection to the real server where client intended to connect (you'll have to know the original destination IP from the router somehow). Then you pass some IMAP commands and replies over forth and back, probably scanning email bodies and attachments appearing there. You could block, replacing some attachment with "sorry, here was virus and we disabled delivery" and so on. Be prepared, IMAP is quite complex protocol, and it is quite popular, and you have to implement the transparent IMAP proxy.
You're well able to intercept and interfere with traffic which is going through unencrypted, but everyone uses TLS today, so you're a lucky that were able to intercept something meaningful and see that it was a e-mail. To circumvent this you have to be able to do SSL/TLS MitM proxying, which is hard to do. SSL MitM proxying is a quite nasty thing, it means you have to run internal certificate authority, make it trusted by all of your internal clients, make your intercepting box automatically generate certificates on the fly which are signed by this special CA, just to appear to client as valid server.
If you fail to install your CA certificate on some client (say, a CEO will have a guest with laptop or tablet PC), their email software will complain about untrusted service, and if it complains about something well-known (for example, gmail) you'll have a very suspicious situation.
And still this is not completely bulletproof, because someone could build a VPN tunnel from your network and communicate over it, bypassing your filters.
There are ready solutions doing this in the market, and they cost accordingly. They are usually able to plug-in several anti-virus scanners. Still, even with that expensive solutin you have to solve the problem of installing CA certificate. It could be easier if you have control on all client machines, (say, you will decide you never encounter guest laptop inside your perimeter, will create a guest network and not filter it at all), but then it might be easier just to integrate scanner into client email software.
It could well send all to check to some scanning server, or scan locally, but this will ensure TLS problem doesn't touch you - client software is one side of encryption tunnel, so it always have the payload in clear text.
If you are in a corporate environment, the enterprise well might have a corporate email service. You could integrate scanner into this service. Different email service setups do things differently, but all are able to operate with a "smtp-proxy" which will invoke scanner for each message going through it. This has an obvious drawback of checking only email going through this server, i.e. for only corporate emails, and not checking the mail coming from externail email services (gmail etc.)

