>11:20 00:00 SMTPD(08470274) [63.10.99.40] ERR domain.com invalid user
><[EMAIL PROTECTED]
>11:20 00:00 SMTPD(08470274) [63.10.99.40] RCPT To:<[EMAIL PROTECTED]>
>11:20 00:00 SMTPD(08470274) [63.10.99.40] ERR domain.com invalid user
><[EMAIL PROTECTED]
>11:20 00:00 SMTPD(08470274) [63.10.99.40] RCPT To:<[EMAIL PROTECTED]>
>11:20 00:00 SMTPD(08470274) [63.10.99.40] ERR domain.com invalid user
><[EMAIL PROTECTED]
>11:20 00:00 SMTPD(08470274) [63.10.99.40] RCPT To:<[EMAIL PROTECTED]>
>
>We are talking about 1 per second all day!
you're getting mail bombed, go to your router, hope they keep their
ip, and block 63.10.99.0/24
>I have taken all the usual precautions that the manual says to take and if I
>understand from these log files, the mail is not being relayed.
no, you are the ends, not the means.
>constant hammering is causing my server and network problems.
yep, mail bomb is Denial of Service.
>Everytime I add another ip address to the excluded list in the mail
>relay list they
>change their ip!! If anyone has a solution to this I would be very grateful.
I was going to recuse myself from the fella question about imgate vs
declude, but this is too good to pass up. With imgate on a 2nd box,
IMGate can stop this crap, bleed for ya, before it gets to Imail,
who just keep right on waltzing along.
With a one box solution, that box has to eat/fight this DoS crap AND
try to keep the services going.
Len
http://BIND8NT.MEIway.com : ISC BIND 8.2.2 p5 & 8.2.3 T6B for NT4 & W2K
http://IMGate.MEIway.com : Build free, hi-perf, anti-spam mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
