IP Address

So, the IP address is on your local network? If so, do you have access to your local DHCP server? If so you could find the lease for the IP address in question and it should (if Windows Server, anyway) show the computer name. You could also use nbtstat -A + IP Address to find the machine name if it is on your LAN.

Obviously, if the address is not on your LAN you can just block the address at the Barracuda device.

Let me know if that helps or you have further questions.

"nbtstat -A 10.x.x.x"

will give you NetBIOS name and what domain/workgroup the computer belongs to

couldn't you isolate that ip with the firewall? tall it to block all ports from that IP? until the boss gets back anyways

I would be blocking all outgoing mail ports to the internet except for the server from within the router. If you only allow the server to use these ports then the server has to be sending the email through the internet.

This will still allow the users to send emails as they use this server. This would also stop you from being placed on these black lists.

After that I would be scanning every machine in the office to check for malware as this stuff can spread.

To find the overall machine thats causing the problem I would then look the IP address up in the lease table which will then give you the computer name. If you keep records of what computer is where you will then be able to go to the exact location of the computer.

Thanks,
Matt

1. if your Exchange server is sending out spam, how do you know this?

2. if your users are receiving spam in their mailbox from outside sources, then the problem is that you don't have any antispam applications running that would catch and delete the spam before it ever reaches the Exchange server. To combat spam, you will have to buy either a hardware device that is specially designed for spam or a software application for Exchange server that catches spam before it gets to Exchange.

3. If you purchased the Barracuda antispam and firewall device and the antispam component isn't working, then Barracuda should provide you with support on how to configure your device for use with Exchange Server. Chances are your antispam component isn't configured properly to either delete suspected spam or move it to the users spam mail folder. you could opt to pull out the manual and reverify all the configuration parameters. If spam is still getting through your antispam appliance, then Barracuda should provide support. If they don't, then suggest you find a new vendor. Barracuda is usually pretty good in providing support for their products. If not, lodge a complaint .....

side note: just read your other post, if the antispam/firewall device is blocking spam, then it's doing its job. If those 23,000 spam emails found their way into the users mail box, then it's not.

If your worried about the large number of spam emails being blocked, don't because the device is doing what it's supposed to be doing, blocking them. The logs that say it's blocked 23,000 spam emails is simply for reporting purposes so that the cost for it is justified.