|
ik8sqi -> RE: Spam problems (30.Mar.2008 5:18:48 PM)
|
It may be too late, but I'll reply anyways...
Please note that many many viruses/trojans will *not* use your Exchange server when clients get infected. The malware will instead send the emails directly to the internet from the infected client. The only way to detect this traffic then is by monitoring the firewall and/or the main switches all the client's traffic goes thru on the way out to the internet. You will need to monitor outgoing TCP traffic on port 25. You should not see any traffic at all except originating from your Exchange server's IP address. If some of your clients are using their workstations to send out their personal emails, you may see a handful of outgoing connections to various ISP providers.
You will *easily* figure out what is legitimate traffic and what is caused by viruses, as in the latter case you will often see numbers in the 10,000+ emails/hours being sent.
|
|
|
|