Re: Tracking source of outbound SMTP messages

I would try a comm trace. It shows source & destination IP's.
like:
start
STRCMNTRC CFGOBJ(ETHTCP) CFGTYPE(*LIN) MAXSTG(32M)
let it run a while
end
ENDCMNTRC CFGOBJ(ETHTCP) CFGTYPE(*LIN)
print
PRTCMNTRC CFGOBJ(ETHTCP) CFGTYPE(*LIN) FMTTCP(*YES)
you can filter the ports - like 110 for pop3 and 25 for smtp with the
sltport parm.
i'm not running smtp on this server so i can't try this)

Otherwise - your network people may have a sniffer program.
hth
jim

----- Original Message -----
From: "Douglas Handy" <dhandy1@xxxxxxxxxxxxx>
To: <MIDRANGE-L@xxxxxxxxxxxx>
Sent: Wednesday, May 14, 2003 4:57 PM
Subject: Tracking source of outbound SMTP messages


> When using the SMTP server in V5R1, how can you trace the source of the
mail?
>
> I have a client infected by the Fizzer virus earlier this week.  They
updated
> the virus definitions and cleaned each PC where they were aware it
occured.  But
> there is still a lot of outbound mail happening, or so it seems.
>
> Using NETSTAT *CNN, there are a few copies (typically 4) where the remote
> address is their ISP's mail server, the remote port is smtp, and the
outbound
> byte counts just keep rising.  But they can't figure out which PC(s) may
be the
> culprit.  The ones they knew were previously infected now test clean (per
vendor
> tool reports anyway).
>
> Scrolling through the NETSTAT *CNN lists, none of the local PC's show up
with
> smtp as the local port.  Relay is blocked via Ops Navigator configuration.
>
> How can I find the IP address of the machine(s) sending the mail?
>
> I tried CHGSMTPA to turn on journaling, but QUSRSYS/QZMF doesn't seem to
tell me
> much either.
>
> They are normally a real low volume mail environment, so the built-in SMTP
> server has been sufficient for them.  But it doesn't keep logs (that I can
> find), and they can't figure out what PC(s) might still be infected.
>
> Any advice?
>
> Doug
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>