Tracking down SPAMMERS Tracking down SPAMMERS using server bandwidth can be a daunting task. You can, however, use some tools to help you track down and block these abusive servers or IP addreses. SPAM can consume the SMTPRA bandwidth to a point where legitimate e-mail will be denied due to the service being so busy.

The first step is to familiarize yourself with the following tools:

• TELNET command
• 'smtpra -control 130' command - a MailSite command
• NSLOOKUP
• SAM SPADE (*OPTIONAL* available at www.samspade.org)

The second step is to use the tools:

1. Open a command line
2. Open the MailSite directory
3. Type: SMTPRA -control 130, press enter
4. Next, type: notepad smtpradump.txt
5. A notepad session will open

   The smptradump.txt file contains the current connections per IP, age, and idle state, as well as the current I/O command state. We are only concerned with the Age of these connections. These connections are set in seconds, so 900 seconds is 15 minutes or 900/60.
   In general most connections will be standard SMTP connections, but there will be some connections that have long age limits or idle times; these connections are suspect to being sources of SPAM.

6. After identifying the potential IP addresses, the following needs to be performed:
   • Verify that it is an SMTP host by using the TELNET command: telnet 10.10.10.10 25, where 25 is the SMTP port.
   • Try to find if the address has a valid MX record or DNS entry using NSLOOKUP, see KB doc 10025 for more information.
7. The next and final step is to block those IP addresses or hosts in the reject mail from options in the security settings, or in your firewall.