hi all,
on my qmail box i can see about 20 qmail-smtpd processes. now, this can
either mean that one of my users (allowed through tcp.smtp) is sending lots
of mail out, or another mail server out on the internet is sending lots of
mail in.
about 5 of these processes are from IP addresses that i recognise (in my
system), a couple of them are IP addresses of mail servers that i know, but
there are a substantial number qmail-smtpd processes that have
TCPREMOTEIP=202.59.39.88 (i can tell this by doing a psaxfe)
what is my course of action? these qmail-smtpd processes are just sitting
there... is this a legitimate mail server sending me mail, or someone trying
to spam my system? (or trying to relay through my system?)
I traceroute to the IP address and get no where.
Regards,
Marc-Adrian Napoli
Network Administrator
Connect Infobahn Australia
+61 2 9281 1750
