You can check the SMTP RECEIVE events in the Message Tracking Logs on the hub transport servers.
Get-messagetrackinglog -server <servername> -resultsize 100 -eventid "RECEIVE" | ? {$_.source -eq "SMTP} | Select clientip,totalbytes,timestamp | ft -auto From: David Lum [mailto:david....@nwea.org] Sent: Tuesday, March 09, 2010 10:09 AM To: MS-Exchange Admin Issues Subject: SMTP traffic monitoring We have Exchange 2007 here and I'd like to be able to see what machines are passing SMTP traffic though it - how do I do that? it appears that it can create a CONNECTLOGnnnnn.LOG file - is there something that can parse it so I can view the connections easily? David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ************************************************************************************************** Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. **************************************************************************************************