I've put up a little cgi script here that might be useful:
http://www.rockynet.com/imail.cgi.txt
By default it will read in your current logfile (sysMMDD.txt) (If you aren't
logging full SMTP debug there it won't do you any good). The script will
then look for instances of "unknown user" and variants thereof.
Additionally it has a primitive search facility. If you see a suspicious
entry and want to see what else that particular host has been doing, you can
enter the IP address to get more details. However, the search should match
any string you want to look for in your logs.
You'll need a regular web server and Perl installed on your Imail machine to
use it.
There is also a facility to look at yesterday's logs, but it doesn't have
the In/Out links implemented properly. The basic view and search should
still work.
Mike
----- Original Message -----
From: "Ed Chabot" <[EMAIL PROTECTED]>
To: "IMail_Forum@list. ipswitch. com" <[EMAIL PROTECTED]>
Sent: Thursday, August 09, 2001 10:13 AM
Subject: [IMail Forum] Another attack?
> Is this some kind of attack or relay from an unauthorized source? It
seems
> that we're having a terrible day with regard to email. Where can I find
out
> how to read this stuff?
>
> STAT
> 08:09 09:51 SMTP-(000000AF) 250-PIPELINING
> 08:09 09:51 SMTP-(000000AF) 250-8BITMIME
> 08:09 09:51 SMTP-(000000AF) 250-SIZE 10000000
> 08:09 09:51 SMTP-(000000AF) 250-DSN
> 08:09 09:51 SMTP-(000000AF) 250-DELIVERBY
> 08:09 09:51 SMTP-(000000AF) 250 HELP
> 08:09 09:51 SMTP-(000000AF) >MAIL FROM:<>
> 08:09 09:51 SMTP-(000000AF) 250 2.1.0 <>... Sender ok
> 08:09 09:51 SMTP-(000000AF) >RCPT To:<[EMAIL PROTECTED]>
> QUIT
> 08:09 09:51 POP3D(000001de) logoff for ttsakopoulos R:0, D:0, P:0
> 08:09 09:51 SMTP-(000000AF) 250 2.1.5 <[EMAIL PROTECTED]>...
> Recipient ok
> 08:09 09:51 SMTP-(000000AF) >DATA
> 08:09 09:51 SMTP-(000000AF) 354 Enter mail, end with "." on a line by
itself
> 08:09 09:51 SMTP-(000000AF) >.
> 08:09 09:51 SMTP-(000000AF) 250 2.0.0 f79Dojuu025055 Message accepted for
> delivery
> 08:09 09:51 SMTP-(000000AF) gdeliver smtp.snet.net
[EMAIL PROTECTED]
> (1) <> 2004
> 08:09 09:51 SMTP-(000000AF) >QUIT
> 08:09 09:51 SMTP-(000000AF) 221 2.0.0 smtp.snet.net closing connection
> 08:09 09:51 SMTP-(000000AF) finished C:\IMAIL\spool\Q1ef932b.NTF status=1
>
> Ed Chabot
> The Marlin Firearms Company
> 100 Kenna Drive
> North Haven, CT 06473
> (203)985-3254
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
