Community discussions

MikroTik App
 
User avatar
Caci99
Forum Guru
Forum Guru
Topic Author
Posts: 1073
Joined: Wed Feb 21, 2007 2:26 pm
Location: Tirane
Contact:

Spam autodetect

Thu Sep 20, 2007 3:11 pm

There is a link in the wiki of how to autodetect spammers:
http://wiki.mikrotik.com/wiki/How_to_de ... MTP_output

Well, I tried that, and today I had the chance to verify if it is working and unfortunately it didn't. Our mail server got full within minutes with more than thousands of mail. When I saw that I did a torch on port 25 to see which IP was spamming. Once identified the external IP I dropped it with a firewall rule.

This way I stoped the spamming proccess.
Can anyone improve the above example?

Thanks Toni
 
dentwistle
just joined
Posts: 6
Joined: Mon Sep 17, 2007 8:52 pm

Re: Spam autodetect

Fri Sep 21, 2007 12:57 am

I have used that method for detecting infected computers on my network. The values that they are using are a little high I would change the connection-limit to 5,32 what that means is that any one IP address can open at most 5 smtp connections at any one time. I didn't bother with the connection rate because most mail spamming programs try to open multiple smtp connections at once. These settings have proven invaluable in detecting workstation infections but might need to be tweeked for use with a server.
 
User avatar
Caci99
Forum Guru
Forum Guru
Topic Author
Posts: 1073
Joined: Wed Feb 21, 2007 2:26 pm
Location: Tirane
Contact:

Re: Spam autodetect

Fri Sep 21, 2007 11:02 am

I have noticed that the external IP spaming me yesterday wasn't opening more than two connections at a time, it was using small emails (around 15kb) and sending aproximatly 10 email at once in interval of nearly 10 sec.

On the other hand the mail server inside the LAN does of course use more connections and more data rate. So I exluded the mail server to be proceded through that rule, and let's see how it will work.
 
kvan64
Member Candidate
Member Candidate
Posts: 186
Joined: Tue Apr 10, 2007 1:54 pm
Location: Brisbane Australia
Contact:

Re: Spam autodetect

Sun Oct 14, 2007 10:59 am

The firewall rules are ok but the script appears "invalid" in my script list.
 
User avatar
Caci99
Forum Guru
Forum Guru
Topic Author
Posts: 1073
Joined: Wed Feb 21, 2007 2:26 pm
Location: Tirane
Contact:

Re: Spam autodetect

Mon Oct 15, 2007 11:04 am

The firewall rules are ok but the script appears "invalid" in my script list.
I haven't adapted the script, because I am more focused to see the firewall rule is working.
Is there any spam tool to test it, thus tuning it to my LAN specification?
-Toni-
Don't crash the ambulance, whatever you do
 
kvan64
Member Candidate
Member Candidate
Posts: 186
Joined: Tue Apr 10, 2007 1:54 pm
Location: Brisbane Australia
Contact:

Re: Spam autodetect

Mon Oct 15, 2007 12:58 pm

just use an email program like emailbomb and try it for yourself. See if you got banned from your own network :)
Cheers

Who is online

Users browsing this forum: Bing [Bot], Google [Bot] and 148 guests