SMTP Traffic Monitoring Utility

[MichiganRon]

Like most networks, my network has just a couple of IP addresses which should be generating SMTP traffic. Other IP addresses that generate SMTP traffic are probably infected with a virus.

I would like a utility which will monitor the SMTP traffic on my network and alert me when an unauthorized address starts sending SMTP packets.

Of course, I'd prefer it to be freeware, but this is not completely necessary.

Any suggestions?

Ron

“If you are irritated by every rub, how will you be polished?”

~ Mevlana Rumi


murof siht edisni kcuts m'I - PLEH

 

[peterve]

http://www.ethereal.com

--------------------------------------------------------------------

http://kickme.to/dpsecurity

--------------------------------------------------------------------
How can I believe in God when just last week I got my tongue caught in the roller of an electric typewriter?
---------------------------------------------------------------------

 

[ChrisAC]

Your firewall should only allow outbound SMTP from designated mail servers. So, if you log your clean up rule you should see dropped SMTP from infected machines in your logs.

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[MichiganRon]

Thanks [red]peterve[/red]. I'll check it out.

[red]iproute[/red]: This is great for outbound SMTP traffic, but it won't help for internal traffic. If an infected computer starts sending SMTP traffic to my mail server (both internal), the firewall won't catch it. We scan our mail for viruses, but if it's "0 day" virus, then it will propogate until the DAT updates are available.

<rant>Of course, this wouldn't be a problem if my users would JUST STOP OPENING THE FRICKING VIRUSES!!</rant> Sorry, but this is a "hot button" topic for me.

Anyway, thanks to both of you for your help.

If anyone else has a different suggestion, please contribute to the thread.

Ron

“If you are irritated by every rub, how will you be polished?”

~ Mevlana Rumi


murof siht edisni kcuts m'I - PLEH

 

[peterve]

If you are talking about zip files; why aren't you blocking all zip files below 50Kb ? That will take care of most 0day virusses; and why would someone zip a file if it is that small already...

What kind of mail server are you running ?
Do you have a firewall ?



--------------------------------------------------------------------

http://kickme.to/dpsecurity

--------------------------------------------------------------------
How can I believe in God when just last week I got my tongue caught in the roller of an electric typewriter?
---------------------------------------------------------------------

 

[bcastner]

Add yourself to the Outlook or OE or whatever mail client as an address in the address book.

This simple measure will automaticly notify you if the SMTP service was hijacked.

 

[MichiganRon]

Yes, we have a firewall. However, I am not in charge of administering it. I've asked to have all outbound SMTP traffic not from our mail server to be blocked; However it hasn't been done.

We use GroupWise, which is not normally as susceptible to viruses as Outlook/OE/Exchange.

and why would someone zip a file if it is that small already...

As you're probably aware, you can never predict what a user will do or why they will do it. This is not an option that I can implement (politics).

Add yourself to the Outlook or OE or whatever mail client as an address in the address book.

This simple measure will automaticly notify you if the SMTP service was hijacked.

I don't know how your suggestion would help. We don't use Outlook/OE. In fact, it's not even installed on most computers. We use GroupWise. Most viruses are not written to be able to open the GroupWise address book. They get email addresses from other sources (mainly documents).

Anyway, thanks for both of your suggestions. However, I'm only looking for a way to monitor the SMTP traffic on my network. I have a pretty good grasp of the capabilities of our email server and I am limited by a "higher power" as to what I can/can't do with regard to blocking attachments.

Thanks again,
Ron

“If you are irritated by every rub, how will you be polished?”
~ Mevlana Rumi


murof siht edisni kcuts m'I - PLEH

 

[upciit]

If you find a solution to this please let me know. I have the same need exactly.

Thanks.

 

[raztaboule]

i just use snort as a sniffer but i think it can "kill" tcp connections that will match some rules.
have a look to see if you understand it the way i do.

http://www.snort.org/docs/snort_manual/node16.html

 

[upciit]

Thanks raztaboule. I will look into this. I am not a unix guru though.. So, hopefully I can figure it out.

 

[raztaboule]

snort has been ported on Windows

http://www.snort.org/dl/binaries/win32/

but i'm not a windows guru.....