|
I am looking for a computer sending email, I have an IP of the source, I am trying to locate the machine. It is internal on our domain, we are using NAT. The emails are getting blocked, I am just trying to the computer, any ideas. All the posts I read, is to use wireshark. I have version 1.6.7 Thank you coz |
|
if you have the IP address of the machine, you don't necessarily need wireshark. There are several options: If it's a windows machine:
If it's not a windows machine, or nbtstat did not help:
Regards Great Information but: I have an IP of the source of the email, it's external (112.xxx.xxx.xxx). But I do not have the internal machine, which are (10.xxx.xxx.xxx). The emails are going through email server, but they are being blocked at the gateway. Like I said I have the source IP, someone might be telneting or remoting with the source IP. I am trying to locate machine that is being used on our network. Thank you, Coz
(15 Jun '12, 08:11)
Coz
BTW: If you add a comment to my answer it will be easier to follow the conversation. O.K. I thought the IP is on your LAN as you said: "it is internal on our domain". Anyway, in that case you need Wireshark.
CONSTRAINT: if the spammer sends mail through MAPI (exchange), you need a different capture filter. Try SMTP (port 25) first and see what you find.
(15 Jun '12, 08:21)
Kurt Knochner
thanks, I will try that. Also sorry about the confusion on the post Coz
(15 Jun '12, 09:41)
Coz
|
|
If whatever machine is doing the NAT keeps a record of the internal-IP+port-to-external-IP+port mappings it has in effect at particular times, and you know what time the spam was sent, you could try using that. |
