[svlug] Figuring out who is spamming from my network???

[Mark]

I guess that's true. Although it will be a lot more painful.
The hosting provider notified me days after the incidents, so 
I would have to keep/rotate logs for days/weeks...

MARK
> 
>  
> 
> > -----Original Message-----
> > From: svlug-bounces+msalists=gmx.net at lists.svlug.org 
> > [mailto:svlug-bounces+msalists=gmx.net at lists.svlug.org] On 
> > Behalf Of Tim Utschig
> > Sent: Wednesday, May 23, 2007 12:54 PM
> > To: svlug at lists.svlug.org
> > Subject: Re: [svlug] Figuring out who is spamming from my network???
> > 
> > On Wed, May 23, 2007 at 10:00:03AM -0700, Mark wrote:
> > > How can I find out the user id that was used to 
> authenticate during
> > > the SMTP session?
> > 
> > If you can't find a way to make your MTA log the user 
> authentication,
> > there's always tcpdump, wireshark, etc.  As long as 
> you're/they're not
> > using STARTTLS.
> > 
> > -- 
> >    - Tim Utschig <tim at tetro.net>
> > 
> > _______________________________________________
> > svlug mailing list
> > svlug at lists.svlug.org
> > http://lists.svlug.org/lists/listinfo/svlug
> > 
>