Spambot in company

[Slott]

Hey all, have a question about a certain situation.

At my company, we use 3 static IPs for internet traffic (email etc, a gateway is set for each). We were called by our provider stating than one of our IPs has a spambot on it, we have 48 hours to do something about it. Despite having a paid for anti virus (worry free business - standard by trend micro), it got in. Instead of doing the needle in a haystack approach (check each computer individually), I heard I could set up computer to analyze where the traffic is coming from. Is there a location I could purchase a tool like this, or a guide on how to set one up? Thanks!

[Bockage]

Sounds like you could use something like Wireshark. It's a free protocol analyzer. The program will capture all of the data on your network, which you could then use to track town the source of the spambot. Hope this helps you.

[sruon]

If one of the gateway is a linux box it'd be very easy to find out/mitigate (vnstats, iftop, iptables etc) else if you can plug a computer before the gateway/router and use Wireshark as pointed above it can be helpful.

[rezn0r]

it could very easily be using port 25. depending on your firewall setup block port 25 outgoing and then look for logs showing an ip that's getting blocked. of course this depends on your firewall and what options it offers. this is how i narrowed it down when we had that problem at work.

[Slott]

It is using port 25, however our sales department would be rather unhappy if I blocked all emails going out.

[rezn0r]

that's very true, i kind of worded it bad, you also remind me that i quickly realized that wasn't a reasonable solution, but even blocking it a few minutes let me see the IP show up on the log. Wireshark is pretty cool too, this post got me to check it out.

[Slott]

I guess I didn't post my other reply, I tried blocking port 25 on our FVS 318 router, but it didn't really do anything. Going to look into a firewall or wireshark solution. Sucks I can't find the problem though right now.

[Yabby]

etherape you can use to see traffic in a graphical way. You can see where the traffic is coming from, and how much. Wireshark is nice, but etherape would be better if you are not very tech savvy so to speak.