Interpreting Protocol Control Event Log

gdatkins · 06-11-2009, 12:11 PM

Greetings,

I am either having trouble interpreting what I am seeing in the Protocol Control event log, or I'm having trouble believing what I am seeing.

There is a SMTP event (logged and passed, not blocked) about once per minute. The client is always an ip on a class A network - always the same subnet. The Server is always our Exchange server.

We have only 10 users and spam is filtered before it gets to us...there is no way there is an email - incoming or outgoing - once per minute. Exchange Message Tracking confirms this.

What should I take away from this? Are we a spam factory?

Thanks,

dmorris · 06-11-2009, 01:19 PM

that means there is some session matching the smtp protocol.

if the server is your email server I doubt you're sending spam to the world.

clearly there is some smtp communication between that subnet and your server.
are you sure this isn't just incoming email?

gdatkins · 06-11-2009, 01:45 PM

Thanks for the reply....I'm certain it isn't incoming email - the volume of email at the organization is actually quite low. At this point, I'm trying to figure out if it is either our anti-spam service or a monitoring service.....

06-11-2009, 12:11 PM	#1 (permalink)
gdatkins Newbie Join Date: Jan 2009 Posts: 2	Interpreting Protocol Control Event Log Greetings, I am either having trouble interpreting what I am seeing in the Protocol Control event log, or I'm having trouble believing what I am seeing. There is a SMTP event (logged and passed, not blocked) about once per minute. The client is always an ip on a class A network - always the same subnet. The Server is always our Exchange server. We have only 10 users and spam is filtered before it gets to us...there is no way there is an email - incoming or outgoing - once per minute. Exchange Message Tracking confirms this. What should I take away from this? Are we a spam factory? Thanks,

06-11-2009, 01:19 PM	#2 (permalink)
dmorris Untangle Junkie Join Date: Nov 2006 Location: San Mateo, CA URLs submitted: 10 Posts: 6,694	that means there is some session matching the smtp protocol. if the server is your email server I doubt you're sending spam to the world. clearly there is some smtp communication between that subnet and your server. are you sure this isn't just incoming email?

06-11-2009, 01:45 PM	#3 (permalink)
gdatkins Newbie Join Date: Jan 2009 Posts: 2	Thanks for the reply....I'm certain it isn't incoming email - the volume of email at the organization is actually quite low. At this point, I'm trying to figure out if it is either our anti-spam service or a monitoring service.....