tcpdump is a useful tool for dumping packets off the network either to file, or to the screen, its generally available in the distro-packing repositories and is very well documented and tested for situations like this.
You can install tcpdump on the ubuntu router (
apt-get install tcpdump), and configure it to watch for smtp traffic;
# tcpdump -s0 -w/tmp/smtp_dump port 25
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
you can review the file for which hosts are sending smtp traffic from another SSH session;
# tcpdump -qr /tmp/smtp_dump
reading from file /tmp/smtp_dump, link-type EN10MB (Ethernet)
13:27:54.291884 IP g0801.hpl.com.33942 > pz-in-f27.1e100.net.smtp: tcp 0
13:27:54.315294 IP pz-in-f27.1e100.net.smtp > g0801.hpl.com.33942: tcp 0
13:27:54.315323 IP g0801.hpl.com.33942 > pz-in-f27.1e100.net.smtp: tcp 0
13:27:54.339110 IP pz-in-f27.1e100.net.smtp > g0801.hpl.com.33942: tcp 45
you can get more sophisticated output if you install wireshark to your local machine and download the dump files, or use tshark at the ssh command line.
warning: tcpdump will fill your disk in quick time if you have a lot of smtp traffic, so review the output file
ls -lh /tmp/smtp_dump and stop the command with ctrl-c when you have a few MB of data to look at.
Interface options to tcpdump (
-i eth0): if your router uses a different interface than eth0, then you might have to select it with the
-i option e.g.
tcpdump -i bond0 -s0 -w/tmp/smtp_dump port 25