+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 17
Windows Thread, How to track which IP an email came from - Exchange 2003 in Technical; Any ideas? I thought it might be possible to look at the full header of the email, although it appears ...
  1. #1

    Join Date
    Oct 2005
    Location
    Anywhere but in a school ;o)
    Posts
    522
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    How to track which IP an email came from - Exchange 2003

    Any ideas? I thought it might be possible to look at the full header of the email, although it appears that apart from the standard to/cc/subject fields, I can't view anything else.

    All I'm after is a method of tracking down the source IP of an (internal) email...

    TIA

  2. #2

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: How to track which IP an email came from - Exchange 2003

    Exchange isn't RFC compliant when generating headers. You can work round this by either:

    a) make your clients use IMAP/POP3. That way full headers will be generated.

    b) make your clients use webmail and use the web server logs.

  3. #3

    Join Date
    Oct 2005
    Location
    Anywhere but in a school ;o)
    Posts
    522
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: How to track which IP an email came from - Exchange 2003

    There's one word for that: b*gger.

  4. #4

    Join Date
    Jul 2005
    Location
    Lancashire
    Posts
    30
    Thank Post
    1
    Thanked 4 Times in 3 Posts
    Rep Power
    19

    Re: How to track which IP an email came from - Exchange 2003

    You can use message tracking from System Manager, Tools to track messages sent though exchange,

    If it is a message which was BCC'd this will still tell you the sender and who it went to as long as you have enabled logging on your server.

    Can you not check logs for where the sender was logged on.

  5. #5

    Join Date
    Oct 2005
    Location
    Anywhere but in a school ;o)
    Posts
    522
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: How to track which IP an email came from - Exchange 2003

    I think that's my only alternative. Have enabled message tracking but it appears that it'll only take effect from now, rather than pick up earlier messages (which is what I expected).

    Off to do some research.... ;-)

  6. #6

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: How to track which IP an email came from - Exchange 2003

    Message tracking has serious (potentially crippling) performance implications.

  7. #7

    Join Date
    Oct 2005
    Location
    Anywhere but in a school ;o)
    Posts
    522
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: How to track which IP an email came from - Exchange 2003

    That was my other worry, I'll see what I can find out from it overnight, then decide whether to leave it in place or not. I suspect not...

  8. #8

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: How to track which IP an email came from - Exchange 2003

    How about using a real mail server?

  9. #9

    Join Date
    Feb 2006
    Location
    Staffordshire
    Posts
    134
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: How to track which IP an email came from - Exchange 2003

    Quote Originally Posted by indiegirl
    Any ideas? I thought it might be possible to look at the full header of the email, although it appears that apart from the standard to/cc/subject fields, I can't view anything else.

    All I'm after is a method of tracking down the source IP of an (internal) email...

    TIA
    can you not just open the email, file-> properties -> details ?
    so you get like:
    Code:
    Received: from MSFWKC223 [10.133.41.34] by moorlands.staffs.sch.uk
      (SMTPD32-5.04) id AA0B3020206; Wed, 29 Mar 2006 12:05:47 +0000
    Message-ID: <000801c65320$8510afc0$2229850a@MOORLANDSSIXTH.INTERNAL>
    Reply-To: "itassist" <itassist@local>
    From: "itassist" <itassist@local>
    To: <faultdesk@local>
    Subject: Printer credits
    Date: Wed, 29 Mar 2006 12:04:16 +0100
    Organization: Moorlands Sixthform Centre
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    	boundary="----=_NextPart_000_0005_01C65328.E6CDEBD0"
    X-Priority: 3
    X-MSMail-Priority: Normal
    X-Mailer: Microsoft Outlook Express 6.00.2900.2180
    X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
    X-RCPT-TO: <faultdesk@local>
    X-UIDL: 178
    Status: U
    or does it not generate those headers at all?

  10. #10

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: How to track which IP an email came from - Exchange 2003

    or does it not generate those headers at all?
    Exchange isn't an RFC compliant mail server. It only bothers to generate those headers if you post via IMAP/POP3. ie, if you force the issue.

  11. #11
    StewartKnight's Avatar
    Join Date
    Jun 2005
    Posts
    1,587
    Thank Post
    2
    Thanked 27 Times in 21 Posts
    Rep Power
    30

    Re: How to track which IP an email came from - Exchange 2003

    have you tried Right click on the email -> options -> internet headers?

  12. #12

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: How to track which IP an email came from - Exchange 2003

    That doesn't work for Internal <-> Internal emails that don't leave the message store.

    Those headers are only generated by the SMTP/IMAP/POP3 interfaces, as I've tried to explain.

  13. #13

    Join Date
    Feb 2006
    Location
    Staffordshire
    Posts
    134
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: How to track which IP an email came from - Exchange 2003

    bloody microsoft why don't they just use the standards like NORMAL PEOPLE gaarr!

  14. #14

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: How to track which IP an email came from - Exchange 2003

    Because they'd have to compete on an even playing field then.

    Embrace, extend and extinguish

  15. #15
    DMcCoy's Avatar
    Join Date
    Oct 2005
    Location
    Isle of Wight
    Posts
    3,424
    Thank Post
    10
    Thanked 488 Times in 428 Posts
    Rep Power
    111

    Re: How to track which IP an email came from - Exchange 2003

    I assume it just uses mapi for that and then internal would bypass any normal routes for sending messages. If you have a high use email server would you really want it to do a smtp send and recieve for every internal message? I would guess some other mail servers do the same.

    Not that I like exchange, I use mdaemon at home because it doesn't mangle my messages and leaves them in a sensible format than I can import and export via imap, while keeping unmangled headers. I used to use Turnpike which is why I'm a bit picky about these things :P

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. exchange 2003 pop3 and push email
    By in forum Windows
    Replies: 4
    Last Post: 13th November 2007, 04:39 PM
  2. Exchange 2003 or 2007 for internal email only.
    By tosca925 in forum Windows
    Replies: 4
    Last Post: 8th October 2007, 12:59 PM
  3. Email Disclaimers - Exchange 2003
    By timbo343 in forum Windows
    Replies: 4
    Last Post: 9th May 2007, 02:58 PM
  4. Exchange 2003 - the mystery of the hidden email!
    By gazankers in forum Wireless Networks
    Replies: 4
    Last Post: 19th December 2006, 10:16 AM
  5. Replies: 5
    Last Post: 4th July 2006, 05:39 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •