Ok so a basic layout of my LAN:
30 or so Servers(Mostly application/DB servers running Win 2K Server)
All my domain, exchange, and file servers are 2K3.
I have Symantec corp Ed 8.11.1.323 and Mail Security 4.5.
I have a sonciwall firewall.
I have a direct T1 to a sister company in India.
The problem:
I’m getting around 200 virus hits on Symantec mail security between ~11pm and 8am every night. All the hits are W32.Netsky.P@mm.
The sender is always postmaster@mysite.com.
The recipient’s very, but they seemed based off older Maryland and India names.
What I have checked:
I have reverified that I’m not an open relay.
I have attempted to utilize ethereal to examine packet flow. But alas I am not experienced enough with this software package to decipher what it is telling me.
Conclusions:
Am I getting blasted from the outside? If so why isn’t my firewall/Anti-Spam/Anti-Virus blocking it before it gets to my mail server?
If it’s internal(what I suspect) how can I figure out which machine is sending these messages? If it’s someone in India I’m going to need some sort of proof to show the admin over there that his machine has a problem.
You advice is appreciated.
Mike