Is there one specific tool set that your referring to
I use:
<http://unxutils.sourceforge.net>http://unxutils.sourceforge.net
unzip and copy the .exe's onto your shared system path like, or add the unzip dir to your path.
or are there many different tools sets to look at? Which one(s) do you recommend? I like the idea of a cheat sheet for learning the tools.
"obviously"
Here's one that will output to a file all the IPs that connected to your Imail today more than 50 times (wraps)
gawk "/SMTPD.*connect/ {print $4}" sys1025.txt | tr -d "\[\]" | c:\winnt\system32\unixsort.exe -f | uniq -ic | gawk "{if ( $1 > 50 ) print $2 ) }" > /path/to/mta_clients_toomanyconnects.txt.
which says:
1. match line containing SMTPD.*connect in log file sys1025.txt
2. output field 4 (the IP connecting to Imail)
3. translate -delete the characters [ and ] (strip 'em)
4. sort using gnu sort (renamed because Win32 protects its native file sort.exe which doesn't pipe worth a [EMAIL PROTECTED])
5. output unique values -counting the lines per value
6. if the count of connects to Imail is more than 50, output/append the IP to my ACL file that blocks by MTA ip address.
and you can run this hour:58 so that you select also using the hour:minute field and reduce the threshold per day of 500 to 50 per this hour.
What if you are getting hit from a number of different IPs in the same class C and want to block the entire class C ?? (collateral damage is wonderful, aka pre-emptive blocking, is strongly recommended).
gawk "/SMTPD.*connect/ {print $4}" sys1025.txt | tr -d "\[\]" | unixsort.exe -f | cut -d "." -f1-3 | uniq -ic | gawk "{if ( $1 > 10 ) print $2 ) }" >> /path/to/mta_clients_toomanyconnects.txt.
The new filter using the cut command works on IP address to -delimit the fields of the record with "." and selects -field 1 to 3 , if "A.B.C" has more than 10 connects, output put .
trying to catch a spammer sending from Imail with forged [EMAIL PROTECTED] ? Make a file mydomains.txt of all your Imail domains (for Imail 6 log file)
gawk "/rdeliver/ {print $8} " sys1025.txt | tr -d "\<\>]" | egrep -ivf mydomains.txt | unixsort.exe -f | uniq -ic | unixsort -rfn | less
1. select all the log lines for remote_delivery
2. output field8, the envelope "mail from:"
3. strip the left and right tit symbols
4. filter out [EMAIL PROTECTED] that doesn't contain mydomains
5. sort
6. uniq with -counting
7. sort -reverse order (so the most frequent [EMAIL PROTECTED] are at the top of the list)
8. use the file viewer "less" to page through the output
Trying to catch a user sending way too many msgs but using one of your IMail domains as envelope sender? just remove the "v" in the egrep filter (inVert).
Len
_____________________________________________________________________ http://MenAndMice.com/DNS-training: Wash DC; Dallas; Atlanta IMGate.MEIway.com: anti-spam gateway, effective on 1000's of sites, free
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
