----- Original Message -----
From: "Len Conrad" <[EMAIL PROTECTED]>
Len, I always learn some new tricks from reviewing your scripts! A couple
of minor corrections below.
> Here's one that will output to a file all the IPs that connected to your
> Imail today more than 50 times (wraps)
>
> gawk "/SMTPD.*connect/ {print $4}" sys1025.txt | tr -d "\[\]" |
> c:\winnt\system32\unixsort.exe -f | uniq -ic | gawk "{if ( $1 > 50 ) print
> $2 ) }" > /path/to/mta_clients_toomanyconnects.txt.
2 minor corrections: $6 on first "print" statement and lose the last
parenthesis ")"
gawk "/SMTPD.*connect/ {print $6}" sys1025.txt | tr -d "\[\]" | usort.exe -f
| uniq -ic | gawk "{if ( $1 > 50 ) print $2}"
> What if you are getting hit from a number of different IPs in the same
> class C and want to block the entire class C ?? (collateral damage is
> wonderful, aka pre-emptive blocking, is strongly recommended).
>
> gawk "/SMTPD.*connect/ {print $4}" sys1025.txt | tr -d "\[\]" |
> unixsort.exe -f | cut -d "." -f1-3 | uniq -ic | gawk "{if ( $1 > 10 )
print
> $2 ) }" >> /path/to/mta_clients_toomanyconnects.txt.
Again, same 2 minor corrections: $6 on first "print" statement and lose the
last parenthesis ")"
gawk "/SMTPD.*connect/ {print $6}" sys1025.txt | tr -d "\[\]" | usort.exe -f
| cut -d "." -f1-3 | uniq -ic | gawk "{if ( $1 > 10 ) print $2}"
> trying to catch a spammer sending from Imail with forged
> [EMAIL PROTECTED] ? Make a file mydomains.txt of all your Imail
domains
> (for Imail 6 log file)
>
> gawk "/rdeliver/ {print $8} " sys1025.txt | tr -d "\<\>]" | egrep -ivf
> mydomains.txt | unixsort.exe -f | uniq -ic | unixsort -rfn | less
Thanks for the suggestions. I am still working on a cheat-sheet as I have
time and will post soon, and if you are okay with it, I will incorporate
these 3 scripts into it as well.
BTW, sort.exe has been renamed to usort.exe (unixsort.exe by Len), because
W2K includes sort.exe in the system32 directory, so if you drop you unix
tools there, W2K will immediately replace sort.exe with its own version (not
what you want).
Bill
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
