Re: Tracking source of outbound SMTP messages

Hi,
The virus, I think, installs it's own smtp server. If it was running on a pc
on your internal network and sending to the default gateway, you would not
see it on your AS/400 unless you were using it as a firewall/router.  Does
your firewall allow outgoing on port 25 from any or just the 400's smtp
server?  On my setup, I can view the outbound smtp connections at my
firewall and anything not coming from my mail server would be suspect.

Kevin
----- Original Message -----
From: "Douglas Handy" <dhandy1@xxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Wednesday, May 14, 2003 6:38 PM
Subject: Re: Tracking source of outbound SMTP messages


> Scott,
>
> >When e-mail travels through the internet, every SMTP server that handles
> >it should be adding a Received: header to the top of the message.
>
> Yes, but in this case they are the sender and I can't see the headers of
the
> messages (or the messages themselves) in order to track it that way.  And
even
> if I were to track down and find a recipient to have them give me the
headers,
> what it would show is the external IP of the company, not the internal
address
> on the LAN where the message originated.
>
>
> >For example, your message (which  I'm replying to) contained this:
> >Received: from main (162-32.9-67.se.rr.com [67.9.32.162])
>
> And that is not my internal network address, it is my (current) IP cable
> address.  It wouldn't help me determine which machine on my network sent
the
> message.
>
> Doug
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>