Message Tracking (originating IP)

[sdtechlog]

Hello All,
I have an Exch 5.5 server that has some strange messages showing up in the outgoing queue, these messages show no originating address. How would I go about tracking which client machine on our network they originated from?
I currently have everything in Diagnostic Loggin set to none except for Message Transfer, SMTP Interface Events and SMTP protocol log which are set to medium. If I need to change one of these parameters, where would I find the corrisponding log?

Thanks in advance...

 

[cmeagan656]

Its a reverse NDR attack. See faq10-5018

 

[sdtechlog]

that's unlikely since all incoming smtp traffic is routed through a qmail server. Unless someone is connecting from inside of our network, which brings me to my original question of how to track ip addresses of connecting clients.

 

[zbnet]

The IMS logs are in IMCDATA\LOGS. Play with the different settings on the Diagnostic Loggin tab (remember to stop and restart the IMS server each time for the changes to take effect), and see what difference it makes to the log files. Some of the settings means that extra events get logged in the Application Event Log as well, so make sure that is big enough to capture your session without filling up/overwriting.

 

[sdtechlog]

Yes, I set all to Maximum under diagnostic loggin tab. Sent a test message and looked at the logs in imcdata\logs, but there is no reference to the ip address of the connecting client. Am I chasing a shadow? Is this possible in 5.5? Should I be looking elsewhere?