* mxc <m...@jumpingbean.co.za>: > > Hi all, > > It looks like there is a machine on the network that is infected with a bot > of some kind and it is sending spam through our smtp server. It passes all > the smtp restriction and checks so it doesn't bounce and is fillinh up our > queues. I can't seem to see in the maillog which IP address these messages > are originating from. Is there some way to tell which internal ip address > they are being sent from?
Yes, look at the received: headers in the queuefiles. postcat -q ID | less -- Ralf Hildebrandt (ralf.hildebra...@charite.de) snick...@charite.de Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450 570-155 http://www.arschkrebs.de Having been erased, The document you're seeking Must now be retyped.
