I have an intra VLAN network which hops subnets and networks. All Cisco, all working normally.
We presently have a virus on one computer and we are trying to zero in on its origin on our LAN
QMail will tell us the user name ([EMAIL PROTECTED]) but not the original true IP address or computer name
Level = debug for both ClamAV and Qmail but the only origin IP we get is that of the gateway.
I have meticulously examined every possible log in /var/logs/./. and all ClamAV logs and all qmail scanner logs.
only gateway IP is available!
Does anyone know where to look for an email true origin or initialize a higher level of debug?