Wireshark

[MartinRouterKing]

Hi all,

 

I have a problem with exchange. The ip address of the server keeps getting blacklisted.

 

I am trying to use wireshark to see if it a machine using port 25 to send out spam as i have checked the whole of exchange and cant see anything.

 

When i run wireshark and set it to capture nothing comes up.

 

I have been told i either need a hub or make a port a mirror port.

 

if i use a hub do i plug all machines into the hub instead of the switch and then monitor it? Never used wireshark before so haven't got a clue.

 

Thanks

[lostsoul]

What information is on the blacklist page? Is traffic from your ip going to a sinkhole? Command and control traffic going to a sinkhole can also get you blacklisted If so, then you can look for the sinkhole ip in your firewall logs, and trace it back to the infected client. Be careful not to request removal too many times, as if you keep getting blacklisted they may stop you requesting removal. If you are really struggling to find the infection the you could block all traffic to the sinkhole IP in your firewall, but that isn't really the solution.

[tom_newton]

First up, block every machine but your mailserver from tcp/25 outbound. If your firewall allows, monitor that rule: you then have solved the problem AND found the culprit in one move.

 

OTOH, Wireshark is fun and useful, so I will answer your question as posed, as well. In the absence of a mirror/span port on your switch, put a hub where you want to sniff (in this case, between your switch and your firewall, you are looking to find malicious traffic leaving your network). Plug your Wiresharking box into the hub as well (so there are 3 cables in there, 1 to switch, one to fw/router, one to your wireshark PC). Run wireshark as root/administrator (delete as applicable for OS) as you need admin privs to put a network card into promiscuous mode. Be sure you're sniffing the ethernet port not the wifi if its a laptop. Happy huntin'

[psydii]

Step 1: Do as Tom says.

 

However do look at your exchange server again: Do you have any connectors configured on the exchange server that might allow anonymous routing? Note that by default exchange does not seem to have logging enabled on the connectors. (well rather that every time I inherit one, logging is not enabled, so I assume that is the default.) SO also check that your connectors are logging usefully.

[MartinRouterKing]

Thank you everyone. I have checked exchange no open relay and authentication is enabled. I will check the logs. I did block port 25 over night so everything would sit in the queue and couldn't leave. No emails ended up in the queue. Port 25 was not blocked on machines so I have now done this. I did get put on one blacklist today but was thinking maybe it was pending to go on so I may of fixed it but I want to scan anyway so I can find the cause. Need to find a hub now [emoji3][emoji482]

[lostsoul]

What do you get when you look your IP up on the blacklist page? This usually gives you detailed information as to why it is happening.