Archive for Feb 5, 2013

Tcpdump Tips & Tricks

Tcpdump Tips & Tricks

Tcpdump Tips & Tricks 


Finding spammers and dealing with floods of excess mail

Finding Spammers and Dealing With Floods In Exim

Finding Spammers and Dealing with Floods 

[Picture 6.  pic/mta-ube.png]

One of the handiest command I use for administering our exim mail servers is the following:

smtp3:~# exim -bp | exiqsumm
Count  Volume  Oldest  Newest  Domain
—–  ——  ——  ——  ——
1    3072      5h      5h
1    3174     77m     77m
1    7577     74m     74m
52    5120      8h      8h

This gives me a nice breakdown of who my top talkers are and the total volume sent to each domain etc.

Let’s say I suspect a mail attack and have a rogue spammer on my network. One of the easiest way to see this is by simply tailing out the exim mainlog as follows and looking for repeat entries of the same type:

serverName:~# tail -f /var/log/exim_mainlog
2011-01-06 10:49:01 1PanOe-000ME1-Nn =>  R=lookuphost T=remote_smtp [] X=TLSv1:RC4-MD5:128
2011-01-06 10:49:01 1PanOe-000ME1-Nn Completed
2011-01-06 10:49:05 ( [62.XXX.XXX.XXX] Warning: HELO VERIFY
2011-01-06 10:49:10 no host name found for IP address 87.XXX.XXX.XXX
2011-01-06 10:49:10 H=([]) [] Warning: HELO VERIFY []
2011-01-06 10:49:11 1PanP5-000MEI-2e <= H=([]) [] P=esmtp S=706

Let’s say I see a huge amount of mail all showing with a specific recipient and wish to find the message id’s for this.

I can then run the following command:

serverName:~# exipick -i ‘$recipients eq’ | wc -l

Now. If I wish to remove all this Spam mail from my server,
I simply pipe this to xargs and exim -Mrm and this will then remove all mail for this user:

serverName:~# exipick -i ‘$recipients eq’ | xargs exim -Mrm
Likewise, if I identify an IP address, which I believe to be the spammer, I can then find all messages from this IP as follows:

serverName:~# exipick -i ‘$sender_host_address eq XXX.XXX.XXX.XXX’ | wc -l

Again, to remove all of these mails, I simply do the following :

serverName:~# exipick -i ‘$sender_host_address eq XXX.XXX.XXX.XXX’ | xargs exim -Mrm

One or two other things you may find useful. To see the mail headers of a specific mail, try the following:

smtp4:~# exim -Mvh 1PemWa-00005A-Pb
mailnull 26 6

1295260884 0
-host_address XXX.XXX.XXX.XXX.22535
-interface_address XXX.XXX.XXX.XXX.25
-received_protocol esmtp
-body_linecount 58
240P Received: from [XXX.XXX.XXX.XXX] (
by with esmtp (Exim 4.67 (FreeBSD))
(envelope-from )


To see the entire body of this same message, just try :

smtp4:~# exim -Mvb 1PemWa-00005A-Pb

And that’s about it for now. There are many clever ways to monitor your mail queues and ensure Spam is kept to a minimum. The above should give you a good start though.
Another good way to keep track of things is to run eximstate on all Exim-based mail servers. This is a handy rrd based graphing tool to keep track of your mail queues, and you can use this to post process the results etc.