Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
How do you detect a spambot on your network?

Our network of 120 windows machines has 1 or more computers sending spam. Is there an easy way to find that machine, without physically checking each one.

share|improve this question

marked as duplicate by Mark Henderson Aug 22 '11 at 23:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

First of all, block all outgoing SMTP-traffic from machines that don't need it. Then you could check your firewall for hosts trying to access SMTP-servers.

Or you could turn on port mirroring on the border/edge-router and attach a PC with a packet-sniffer on it. Shouldn't be to hard to get the spammers with WireShark.

share|improve this answer

Do a packet capture, or setup some kind of logging filter on your perimeter equipment (firewall or border router). Watch for outgoing traffic destined for port 25. Once you find the IP of the traffic work backwards to find the machine. This may mean looking at the CAM tables on your switches to find out which port is associated with the MAC address the IP belongs to.

Unless you have a strong need for it, I suggest you simply block outbound requests to port 25 from all systems except your mail server.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.